What is the potential issue with using mysqli_real_escape_string() function in PHP?

The potential issue with using mysqli_real_escape_string() function in PHP is that it only escapes special characters for SQL queries, leaving room for other types of attacks such as XSS (Cross-Site Scripting). To solve this issue, it is recommended to use prepared statements with parameterized queries instead, as they provide a more secure way to interact with the database. 

// Using prepared statements with parameterized queries to prevent SQL injection attacks
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a SQL statement
$stmt = $mysqli->prepare("INSERT INTO users (username, password) VALUES (?, ?)");

// Bind parameters
$stmt->bind_param("ss", $username, $password);

// Set parameters and execute
$username = "user1";
$password = "password1";
$stmt->execute();

// Close statement and connection
$stmt->close();
$mysqli->close();

Keywords

mysqli_real_escape_string SQL injection prepared statements parameterized queries data sanitization

Related Questions