PHP / MySQL Parameter Substitution

[lugos]

Hello,I'm fairly new to PHP. Is parameter substitution possible/necessary using PHP and MySQL to prevent SQL injection attacks? Are there any other methods that can be used to protect oneself from those types of attacks?Thanks.

[boen_robot]

Yes, they are possible by the use of PDO statements or MySQLi statements. But it's not required. You can instead use a string escaping function, and concatenate its output (the "safe from SQL injection" string) to the query. For MySQLi, that would be mysqli::real_escape_string().