Ready-made statements completely protected my site from MySQL injections?

Question

I use prepared statements and MySQLi with my queries for protection against injection. Ready-made statements completely eliminate the need for mysql_real_escape_string? Is there anything else I should consider when protecting my site?

Answer 1

As long as you use the prepared instructions correctly, they will. You need to make sure that you bind all external variables and do not put them directly in the query.

for instance

$stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=" . $name);

, , . - SQL-.

, ...

$stmt = $mysqli->prepare("SELECT District FROM City WHERE Name=?")) {
$stmt->bind_param("s", $city);

Answer 2

MySQLi .

. -. , . , . , , .
, .

mysql_real_escape_string?

mysql_real_escape_string. -. , "". .
, , SQL. , , mysql_real_escape_string. ( SQL).

- , ?

.
- , SQL :
.
, , , , .. .