How can the use of mysql_real_escape_string help prevent SQL injection vulnerabilities in PHP?

SQL injection vulnerabilities occur when user input is not properly sanitized before being used in SQL queries, allowing malicious users to manipulate the query. Using mysql_real_escape_string in PHP helps prevent SQL injection by escaping special characters in the user input, making it safe to use in SQL queries. 

// Connect to the database
$conn = mysqli_connect("localhost", "username", "password", "database");

// Get user input
$user_input = $_POST['user_input'];

// Sanitize user input using mysql_real_escape_string
$safe_input = mysqli_real_escape_string($conn, $user_input);

// Use the sanitized input in a SQL query
$query = "SELECT * FROM users WHERE username='$safe_input'";
$result = mysqli_query($conn, $query);

Keywords

mysql_real_escape_string SQL injection vulnerabilities PHP prevention

Related Questions