query: Is it better to use mysqli_real_escape_string (with mysqli) or placeholders (with PDO)?
positive_passages.docid: 255
positive_passages.text: How can I prevent SQL injection in PHP?
negative_passages.docid: 92495
negative_passages.text: PHP PDO: charset, set names?
negative_passages.docid: 62267
negative_passages.text: MySQL stored procedure vs function, which would I use when?
negative_passages.docid: 36792
negative_passages.text: How to escape strings in SQL Server using PHP?
negative_passages.docid: 107510
negative_passages.text: PDO bindParam vs. execute
negative_passages.docid: 95323
negative_passages.text: Is there an equivalent of PHP's mysql_real_escape_string() for Perl's DBI?
negative_passages.docid: 156732
negative_passages.text: Using wildcards in prepared statement - MySQLi
negative_passages.docid: 80725
negative_passages.text: Turning query errors to Exceptions in MySQLi
negative_passages.docid: 52162
negative_passages.text: mysqli bind_param for array of strings
negative_passages.docid: 107307
negative_passages.text: Can I protect against SQL injection by escaping single-quote and surrounding user input with single-quotes?
negative_passages.docid: 104601
negative_passages.text: PDO binding values for MySQL IN statement
negative_passages.docid: 13546
negative_passages.text: Correct way to use LIKE '%{$var}%' with prepared statements? [mysqli]
negative_passages.docid: 149657
negative_passages.text: Alternative to mysql_real_escape_string without connecting to DB
negative_passages.docid: 104897
negative_passages.text: MySQL: "error in your SQL syntax ... near key ..."?
negative_passages.docid: 22836
negative_passages.text: Escape line breaks in MySQL output
negative_passages.docid: 128830
negative_passages.text: Mysqli update throwing Call to a member function bind_param() error
negative_passages.docid: 42138
negative_passages.text: Error: mysqli_stmt::bind_param(): Number of elements in type definition string doesn't match number of bind variables