php - Is mysql_real_escape_string enough to Anti SQL Injection?

Question

In PHP Manual, there is a note:

Note: If this function is not used to escape data, the query is vulnerable to SQL Injection Attacks.

Is this enough to anti sql injection? If not, could you give an example and a good solution to anti sql injection?

Answer 1

mysql_real_escape_string is usually enough to avoid SQL injection. This does depend on it being bug free though, i.e. there's some small unknown chance it is vulnerable (but this hasn't manifested in the real world yet). A better alternative which completely rules out SQL injections on a conceptual level is prepared statements. Both methods entirely depend on your applying them correctly; i.e. neither will protect you if you simply mess it up anyway.