如何补充或更新已弃用的`mysql_real_escape_string` [重复]

Question

This question already has an answer here:

• How can I prevent SQL injection in PHP? 28 answers

I'm a PHP novice, trying to validate HTML form submission via PHP learned in a tutorial.

Code uses mysql_real_escape_string which PHP.net says is deprecated.

Here's an excerpt of that entire section:

/*Cleans an array to protect against injection attacks.*/
function f_clean($array) {
    return array_map('mysql_real_escape_string', $array);
}

What, if anything, should I add or change in the PHP in order maintain this security measure?

</div>

Answer 1

The updated non-deprecated equivalent of mysql_real_escape_string is mysqli_real_escape_string.

However, mysqli_real_escape_string is not infallible! Even though in most practical cases by the average use, you should take precaution and use it in combination with trim(), parameterized inserts, prepared statements, and strict inputs. There are many questions and resources to help you on this.