MySQLi Escape String

Question

Every time I try mysql(i)_real_escape_string the value put into the MySQL table cell is empty. Always. Anyone help? I use the object orientated version of it and I tried the exactly same code with that function and without it, and it worked perfectly when it was not there.

Answer 1

Three rules to get it right:

1. do not use this function in the application code
2. do not put your variables directly into query but use prepared statements
3. do not use raw mysqli in the application code but use some higher level abstraction, at least PDO