phpmysqlcode-injectionmysql-real-escape-string

When to use mysql_real_escape_string()

When is the correct time to use mysql_real_escape_string?

Should I be using it when I use isset(mysql_escape_string($_GET['param'])),

Should I be using it when I use $foo = mysql_real_escape_string($_GET['bar']);

Thanks

Solution

  • You need to call this function when building SQL queries with string literals.
    You should not call it anywhere else.

    The point of calling this function is to prevent you from executing SQL like SELECT * FROM Students WHERE Name = 'Robert'); DROP TABLE Students;--'.
    mysql_real_escape_string will escape the ' character so that the evil string is treated entirely as a string.