什么时候最推荐使用mysql_real_escape_string（）

Question

Im actually new to using this function.. and was using preg_replace and addslashes previous to finding it.

I'm mostly curious, because Im about to go through, and tighten security in the posting areas in my first large app, and wanted to know the best instances where this function is effective, and highly recommended. I've seen this function applied in a few different situations, and not just before user input is posted.. but when queries are done in general, so Im really curious about its full possibilities, and how to implement it to its full effectiveness.

Also, any infallible security methods, and suggestions in general will be really appreciated.

Cheers all!

Answer 1

Ideally you should never be using it, because Parameterized queries (either through PDO or mysqli) are the correct way to prevent SQL injection.