Mysqli Escape Strings

[Pain]

Hello. I have started using prepared mysqli statements such as this.

 

$username = $_POST['username'];
$password = $_POST['password'];
$password_repeat = $_POST['password_repeat'];
$email = $_POST['email'];

if ($stmt = $mysqli->prepare("INSERT INTO ww3_users (username, password, password_repeat, email) VALUES (?, ?, ?, ?)")) {

$stmt->bind_param('ssss', $username, $password, $password_repeat, $email);
$stmt->execute();
$stmt->close();
}

 

The question is - do i have to escape strings?

 

Thank you:)

[Christian F.]

Not when using Prepared Statements, no. They take care of the escaping automatically.

[Pain]

Thank you Christian

[Christian F.]

You're welcome, glad I could help.