Manual Screening in the Doctrine

Question

When you write your own SQL statements using Doctrine, how should you avoid input? In my experience, it mysql_real_escape_stringdoes not work.

Answer 1

When mysql_real_escape_string()used correctly, it works great. Parameterized libraries such as ADODB and PDO will not work without it. I highly recommend using PDO.