What are the potential pitfalls of using addslashes function in PHP for data sanitization?

The addslashes function in PHP is not sufficient for proper data sanitization as it only adds slashes to certain characters, leaving room for SQL injection attacks. To properly sanitize data, it is recommended to use prepared statements with parameterized queries. 

// Using prepared statements with parameterized queries for data sanitization
$stmt = $pdo->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

Keywords

addslashes data sanitization SQL injection security vulnerability escape characters

Related Questions