mysql_real_escape_string

[steviemac]

Could someone tell me if this is the proper use of mysql_real_escape_string or is there something better or more code that I can use to help prevent sql injections?

 

$find = mysql_real_escape_string($find);
$data = mysql_query("SELECT * FROM myuser WHERE upper(email) ='$find' LIMIT 1");

while($result = mysql_fetch_array( $data ))
{
echo "Success";
}

 

Thank You for your help.

[premiso]

It looks proper to me.

 

If you want to better prevent against SQL Injections, look into using Prepared Statements via PDO / MySQLi.

[steviemac]

Thanks for your help