What are the security risks associated with using addslashes() instead of escape functions in PHP for database queries?

Using addslashes() instead of escape functions in PHP for database queries can leave your application vulnerable to SQL injection attacks. It is recommended to use escape functions like mysqli_real_escape_string() or prepared statements to properly sanitize user input before including it in SQL queries. 

// Using mysqli_real_escape_string() for sanitizing user input
$user_input = mysqli_real_escape_string($connection, $_POST['user_input']);
$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysqli_query($connection, $query);

Keywords

security risks addslashes() escape functions database queries PHP

Related Questions