What role does mysql_real_escape_string play in protecting against SQL-Injections in PHP?

mysql_real_escape_string is a function in PHP that helps protect against SQL Injection attacks by escaping special characters in a string before sending it to a MySQL database. This function ensures that any user input that is used in SQL queries is properly sanitized, preventing malicious users from injecting harmful SQL code into your queries. 

// Example of using mysql_real_escape_string to protect against SQL Injection
$user_input = $_POST['user_input']; // Assuming user_input is coming from a form submission

// Sanitize the user input before using it in a SQL query
$escaped_user_input = mysql_real_escape_string($user_input);

// Use the sanitized input in your SQL query
$query = "SELECT * FROM users WHERE username = '$escaped_user_input'";
$result = mysql_query($query);

Keywords

mysql_real_escape_string SQL-Injections PHP security protection

Related Questions