php - Why mysqli_real_escape_string have a connection object as a first parameter -
i'm using mysqli functions in php long time. , ask me same thing: why funcion mysqli_real_escape_string
needs connection in first parameter? doesn't make sense! it's funcion scape quotes.
do know why?
mysqli_real_escape_string
must aware of character set of connection can escapes special characters properly. if use multi-byte set mysqli must know. otherwise sql injection possibile. see this answer more detail.
however, don't use it! use prepared statements!
Comments
Post a Comment