当查询中的变量没有引号时，是否可以使用mysql_real_escape_string进行SQL注入？

Question

Take for example this

$username = mysql_real_escape_string($_GET['username']);
$password = mysql_real_escape_string($_GET['password']);
$sql = "SELECT * FROM users WHERE username = $username AND password = $password";

If there are no quotes around $username and $password, is injection still possible ?

Answer 1

If there are no quotes around $username and $password, is injection still possible ?

Yes. mysql_real_escape_string() prevents only escaping from the quotes in a string.

Without surrounding quotes, mysql_real_escape_string() is useless.