How can the use of mysqli_real_escape_string() or Prepared Statements prevent security vulnerabilities in PHP code?

Using mysqli_real_escape_string() or Prepared Statements can prevent security vulnerabilities in PHP code by properly escaping special characters in user input, which helps prevent SQL injection attacks. These functions ensure that user input is treated as data rather than executable SQL code, making it safer to use in database queries. 

// Using mysqli_real_escape_string()
$connection = mysqli_connect("localhost", "username", "password", "database");
$username = mysqli_real_escape_string($connection, $_POST['username']);
$password = mysqli_real_escape_string($connection, $_POST['password']);

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($connection, $query);

// Using Prepared Statements
$connection = new mysqli("localhost", "username", "password", "database");
$stmt = $connection->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $_POST['username'], $_POST['password']);
$stmt->execute();
$result = $stmt->get_result();

Keywords

mysqli_real_escape_string Prepared Statements security vulnerabilities PHP code SQL injection

Related Questions