Is MySQLi's "mysqli_real_escape_string" Sufficient Against SQL Attacks?

Your code attempts to protect against SQL injections using "mysqli_real_escape_string()".但是，如URI2X所示，此度量不足。

漏洞到sql indection [mysqli_real_escape_scape_string（）注射攻擊。例如，以下代碼仍然可能是脆弱的：）; $ query =“從email ='”的用戶中選擇 *。 $電子郵件。 “'”;

）; $ psw = mysqli_real_escape_string（$ db_con，$ _post ['psw']）; $ stmt-> execute（）;

$email = mysqli_real_escape_string($db_con, $_POST['email']);
$query = "SELECT * FROM users WHERE email = '" . $email . "'";

"mysqli_real_escape_string()" alone is insufficient to protect against SQL injections.準備的陳述和嚴格的白名單為這些攻擊提供了更強大的保障措施。