在MySQLi中绑定参数和转义字符串（PHP）

Question

I bind all variables to all kind of statements (UPDATE/INSERT/SELECT etc.) using the bind_param() function. But I am confused with bind params.

Do I also need to use real_escape_string even though I use bind_param? Are both of them completely different things?

Answer 1

No you don't need to escape them. Binding params eliminates the need for escaping by removing the dangers of string concatenation.

With binding, you're essentially telling MySQL to use the contents of this variable as the value for this field.