What is the potential issue with using mysql_real_escape_string() in the provided PHP code?

Using `mysql_real_escape_string()` can potentially introduce SQL injection vulnerabilities if not used properly. It is recommended to use prepared statements with parameterized queries instead, as they provide a safer and more secure way to interact with the database. Prepared statements automatically handle escaping and sanitizing user input, reducing the risk of SQL injection attacks. 

// Fix using prepared statements with parameterized queries
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a statement
$stmt = $mysqli->prepare("INSERT INTO users (username, password) VALUES (?, ?)");

// Bind parameters
$stmt->bind_param("ss", $username, $password);

// Set parameters and execute
$username = $_POST['username'];
$password = $_POST['password'];
$stmt->execute();

// Close statement and connection
$stmt->close();
$mysqli->close();

Keywords

mysql_real_escape_string SQL injection deprecated security vulnerability mysqli or PDO.

Related Questions