SQL injection is one of the most common vulnerabilities in applications on the web today. This article will show you how to prevent SQL injection on your website using Prepared Statements in PHP.

You can handle all escape characters smartly in scripting languages like PERL and PHP. The MySQL extension for PHP provides the function mysql_real_escape_string() to escape input characters that are special to MySQL.


if (get_magic_quotes_gpc())

{

  $name = stripslashes($name);

}

$name = mysql_real_escape_string($name);

mysql_query("SELECT * FROM users WHERE name='{$name}'");
The LIKE Quandary:
To address the LIKE quandary, a custom escaping mechanism must convert user-supplied % and _ characters to literals. Use addcslashes(), a function that let's you specify a character range to escape.

$sub = addcslashes(mysql_real_escape_string("%something_"), "%_"); // $sub == %something_ mysql_query("SELECT * FROM messages WHERE subject LIKE '{$sub}%'");