Why is mysqli_real_escape_string() recommended for values inserted into SQL queries in PHP?

Using mysqli_real_escape_string() is recommended for values inserted into SQL queries in PHP to prevent SQL injection attacks. This function escapes special characters in a string, making it safe to include in a SQL query. By using this function, you can ensure that user input is properly sanitized before being used in database queries, reducing the risk of malicious code being executed. 

// Connect to the database
$connection = mysqli_connect("localhost", "username", "password", "database");

// Get user input
$user_input = $_POST['user_input'];

// Sanitize user input using mysqli_real_escape_string
$sanitized_input = mysqli_real_escape_string($connection, $user_input);

// Insert sanitized input into a SQL query
$query = "INSERT INTO table_name (column_name) VALUES ('$sanitized_input')";

// Execute the query
mysqli_query($connection, $query);

// Close the connection
mysqli_close($connection);

Keywords

mysqli_real_escape_string SQL queries PHP security injection

Related Questions