Prepared statements only. Because nowhere escaping is the same thing. In fact, escaping has absolutely nothing to do with whatever injections, and shouldn't be used for protection.
While prepared statements offer the 100% security when applicable.
Question
Should I use mysqli_real_escape_string
or should I use prepared statements?
I've seen a tutorial now explaining prepared statements but I've seen them do the same thing as mysqli_real_escape_string
but it uses more lines
Are there any benefits for prepared statements? What do you think is the best method to use?
Solution
Prepared statements only. Because nowhere escaping is the same thing. In fact, escaping has absolutely nothing to do with whatever injections, and shouldn't be used for protection.
While prepared statements offer the 100% security when applicable.
OTHER TIPS
Use prepared statements
because after using this you doesn't have to use mysqli_real_escape_string
. prepared statements
doing this as by default.
It's very easy to forget (maybe not for you, but other developers you work with) to escape whereas it's very hard to use prepared statements incorrectly to cause a vulnerability. So prepared statements.