mysqli_real_escape_string(); vs filter_var(); vs Prepared Statements
Which one is more secured?
bhukkel
11:42 am on May 8, 2017 (gmt 0)
I check all my input with filter functions like filter_var or my own functions. Regardless if its end up stored in a database. There are more hacks or bugs possible than sql injection.
For Mysql i use the Mysqli functions with prepared statements. I think prepared statements and real_escape are both secure as long as you use them correctly. But it is easy to forget the escape function so i just learned to always use prepared statements.
