Is MySQLi secure without mysql_real_escape_string

Hi,

I've tried but failed to put mysql_real_escape_string into functioning with MySQLi. So, is it secure to let users login and signup without prevent MySQL injection with this feature. How do you guys get around this problem. I'm new to MySQLi thing but considered to migrate my database command from MySQL to MySQLi.

Thanks
Ket

 

Can you post the code you're using. It's always best to sanitize inputs. You don't have to use real_escape_string but it is necessary to use some method to preventing sql injection.

MySQLI also uses a different method of escape. http://php.net/manual/en/mysqli.real-escape-string.php

It's not the same function as mysql_real_escape_string.

 

Thanks jestep,

I'm looking for exactly what you suggested. Never imagine it is that simple.