Why is it important to use addslashes() or mysql_escape_string() functions when inserting data into a MySQL database using PHP?

It is important to use addslashes() or mysql_escape_string() functions when inserting data into a MySQL database using PHP to prevent SQL injection attacks. These functions escape special characters in the input data, ensuring that the data is safe to insert into the database without causing any unintended SQL queries to be executed. 

// Example of using addslashes() function to insert data into a MySQL database
$conn = new mysqli($servername, $username, $password, $dbname);

$name = addslashes($_POST['name']);
$email = addslashes($_POST['email']);

$sql = "INSERT INTO users (name, email) VALUES ('$name', '$email')";

if ($conn->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();

Keywords

addslashes mysql_escape_string MySQL database PHP data insertion

Related Questions