What is the best way to escape a string before inserting into the database. addslashes () or mysql_real_scape_string ()?

Question

What is the best way to escape a string before inserting into the database. addslashes () or mysql_real_scape_string ()?

Navigation

#1 by (2 votes)

3

I am developing a project that involves passwords among other important information that I need to insert into the mysql database.

My question is which option should I use to escape this data against sql injection. Right now I'm using a regular expression that removes the unwanted characters. I'm using the PDO.

php sql

asked by anonymous 11.11.2015 / 14:16

1 answer

Add dependency in android studio Orientation Ruler

score 2 · Answer 1

mysql_real_scape_string() should be discarded because it is deprecated, removed from php7 and needs a mysql connection. *

Let the PDO take care of escaping the characters using prepared statements.