phpmysqliprepared-statementmysql-real-escape-string

Should I use mysqli_real_escape_string or should I use prepared statements?

Should I use mysqli_real_escape_string or should I use prepared statements?

I've seen a tutorial now explaining prepared statements but I've seen them do the same thing as mysqli_real_escape_string but it uses more lines

Are there any benefits for prepared statements? What do you think is the best method to use?

Solution

  • Prepared statements only. Because nowhere escaping is the same thing. In fact, escaping has absolutely nothing to do with whatever injections, and shouldn't be used for protection.

    While prepared statements offer the 100% security when applicable.