php - Why mysqli_real_escape_string have a connection object as a first parameter -


i'm using mysqli functions in php long time. , ask me same thing: why funcion mysqli_real_escape_string needs connection in first parameter? doesn't make sense! it's funcion scape quotes.

do know why?

mysqli_real_escape_string must aware of character set of connection can escapes special characters properly. if use multi-byte set mysqli must know. otherwise sql injection possibile. see this answer more detail.

however, don't use it! use prepared statements!


Comments

Popular posts from this blog

angularjs - ADAL JS Angular- WebAPI add a new role claim to the token -

node.js - Using Node without global install -

php - CakePHP HttpSockets send array of paramms -