What are the drawbacks of using real_escape_string() for data sanitization in PHP?

Using real_escape_string() for data sanitization in PHP is not recommended because it only escapes special characters for SQL queries and does not protect against all types of attacks, such as XSS attacks. It is better to use prepared statements with parameterized queries to prevent SQL injection attacks and ensure safer data sanitization. 

// Using prepared statements with parameterized queries for data sanitization
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);
$stmt->execute();
$result = $stmt->get_result();

Keywords

real_escape_string data sanitization drawbacks SQL injection security

Related Questions