Is it advisable to use strip_tags() function on user input when working with SQL queries in PHP?

When working with SQL queries in PHP, it is not advisable to use strip_tags() function on user input as it only removes HTML tags and does not provide protection against SQL injection attacks. To prevent SQL injection, it is recommended to use prepared statements with parameterized queries or escape user input using functions like mysqli_real_escape_string(). 

// Using prepared statements to prevent SQL injection
$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

$username = $_POST['username'];
$stmt->execute();
$result = $stmt->get_result();

// Process the result

$stmt->close();
$conn->close();

Keywords

strip_tags user input SQL queries PHP security

Related Questions