Is it best practice to escape data before inserting into a database using mysqli_real_escape_string in PHP?

When inserting data into a database using PHP and MySQL, it is best practice to escape the data to prevent SQL injection attacks. One way to do this is by using the `mysqli_real_escape_string` function in PHP, which escapes special characters in a string for use in an SQL statement. This function helps to ensure that the data being inserted into the database is safe and does not contain any malicious code. 

// Establish a connection to the database
$connection = mysqli_connect("localhost", "username", "password", "database");

// Escape user input for security
$name = mysqli_real_escape_string($connection, $name);
$email = mysqli_real_escape_string($connection, $email);
$age = mysqli_real_escape_string($connection, $age);

// Insert the escaped data into the database
$query = "INSERT INTO users (name, email, age) VALUES ('$name', '$email', '$age')";
mysqli_query($connection, $query);

// Close the database connection
mysqli_close($connection);

Keywords

PHP mysqli_real_escape_string database data insertion security

Related Questions