DB_escape_string

[icedlava]

Hi Jo, I follow the PHP and PHP-DEV mailing lists and recently there has been a lot of debate about the best way to go for this. Paramaterised queries undoubtedly have their proponents, but I am surprised you call it an accepted standard.

By opening and closing the prepared statement within the same function do we not lose the main benefit where there are repeated queries?

Tim

Hi Tim,

Yes I follow the mailing lists too.

As I said previously, the main benefit we have and why this all started is for security of code, not for performance or other reasons that may be one of the many pros or cons of prepared statements. You will not get protection just using mysqli_db_escape_string. As you'd know, SQL injection works by including malicious string data when it creates SQL to send to the database. Bind vars work is because the sql string with the placeholders and the parameter array are sent to the mysql server separately and it is only there they are combined for execution.

Security and data integrity - that is why we have bindvars which use the prepared statements. Feel free to change it as you and phil see fit.

Would you like to go to PDO instead?

Cheers,
[Edited - added point about SQL injection]