Are there specific PHP functions or extensions that should be used instead of mysql_real_escape_string for input sanitization to prevent SQL injection attacks?

To prevent SQL injection attacks, it is recommended to use parameterized queries or prepared statements instead of mysql_real_escape_string for input sanitization in PHP. This helps to separate the SQL query logic from the user input data, making it more secure and reliable. 

// Using prepared statements to prevent SQL injection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $_POST['username']);
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

PHP input sanitization SQL injection functions extensions

Related Questions