What are the differences in escaping variables between mssql_query and PDO in PHP?

When using mssql_query in PHP, you need to manually escape variables to prevent SQL injection attacks by using functions like mssql_real_escape_string. However, when using PDO, you can use prepared statements with placeholders, which automatically handle escaping for you, making your code more secure and easier to maintain. 

// Using mssql_query
$unsafe_variable = $_POST['user_input'];
$escaped_variable = mssql_real_escape_string($unsafe_variable);
$query = "SELECT * FROM users WHERE username='$escaped_variable'";
$result = mssql_query($query);

// Using PDO
$unsafe_variable = $_POST['user_input'];
$query = "SELECT * FROM users WHERE username=:username";
$stmt = $pdo->prepare($query);
$stmt->bindParam(':username', $unsafe_variable);
$stmt->execute();

Keywords

mssql_query PDO escaping variables differences PHP

Related Questions