将变量转换为字符串

Question

I am making a login, and will use this for registration, and am allowing symbols and special characters in emails and passwords. I know that this poses a serious threat for hackers with injections. My question is: How might I turn the inputs from fields (ex. 'email', 'password'), into strings and not allow the server to process them as code and commands.

I truly have very little clue as to where to start, but have tried mysqli_escape_string; but, as you most likely know, it is very thin and deprecated. I don't mind researching a little, I would just greatly appreciate a bit of information to get started!

Answer 1

1. Use prepared statements when executing mysql queries. (more details here)
2. Limit input field length when possible (normally a mysql injection queries are long. This prevents execution of altered longer queries even there is a vulnerability made by a mistake)
3. Give only the permissions needed for mysql users. Wherever you only need the user to read, provide only read permissions.
4. Encrypt sensitive data like passwords. Use salted password hashing.