php - What's the use of mysqli_real_escape_string in case of ' / ' and ' \ ' and ' ' '? -

this question has answer here:

• how can prevent sql injection in php? 28 answers

whats use of mysqli_real_escape_string if user inputs

/  \  ' 

in input field ?

are harmful ?

and if , what's harm ?

the risk of ' character literal quote character in input can prematurely close quoted string in sql expression. example:

update users set password = '$pass' userid = $id 

this assumes $input safe within string. if pass url this:

http://example.com/setpassword.php?id=1234&pass=xyzzy', admin='1 

i can trick code doing this:

update users set password = 'xyzzy' , admin='1' userid = 1234 

giving myself admin privileges.

the purpose of functions mysqli_real_escape_string() prevent that, ensuring literal quote characters not used terminate string in input copied.

so worst set password long, strange string:

update users set password = 'xyzzy\' , admin=1' userid = 1234 

it's more convenient bind input variables query using parameter placeholders, instead of copying them directly string.

<?php  $stmt = $mysqli->prepare("update users set password = ? userid = ?"); $stmt->bind_param("si", $pass, $id); $stmt->execute(); 

that way don't have worry escaping, or imbalanced quotes. makes code nicer, easier read, , easier debug , maintain.

the drawback parameters take place of scalar value only. can't use them insert dynamic table names, column names, expressions, sql keywords, etc. put string literal, date literal, or numeric literal in sql code.