How can PHP functions like mysql_real_escape_string help prevent errors when inserting data into a database?

When inserting data into a database, it is important to sanitize the input to prevent SQL injection attacks. PHP functions like mysql_real_escape_string can help prevent errors by escaping special characters in the input data, making it safe to insert into a database without causing syntax errors or security vulnerabilities. 

// Connect to the database
$connection = mysqli_connect("localhost", "username", "password", "database");

// Sanitize input data using mysql_real_escape_string
$name = mysqli_real_escape_string($connection, $_POST['name']);
$email = mysqli_real_escape_string($connection, $_POST['email']);
$age = mysqli_real_escape_string($connection, $_POST['age']);

// Insert sanitized data into the database
$query = "INSERT INTO users (name, email, age) VALUES ('$name', '$email', '$age')";
mysqli_query($connection, $query);

// Close the database connection
mysqli_close($connection);

Keywords

PHP mysql_real_escape_string database insertion data sanitization SQL injection

Related Questions