使用mysqli_real_escape_string在MySqli中清理我的数据

Question

I am converting my functions over from mysql to mysqli. In mysql I use a general function that I can parse data into to remove SQL threats. I have tried using this method in mysqli however any data that goes through it, doesn't come back out. If I var_dump the string I get the result

string(0) ""

This is my function

function sanitize($data) { 
return htmlentities(strip_tags(mysqli_real_escape_string($data))); 
} 

Answer 1

You don't really need to use myslqi_real_escape_string().

Instead, just use prepared statements (look for examples in this PHP documentation page), and you will be just fine.

In addition to protecting from bad data, prepared statements also may work faster, especially for repeated data.