PHP/MYSQL Prevent sql injection attacks function -
i want upgrade , make more systematic, protection against sql injection attacks. gather 3 main methods pdo, prepared statements , mysql_escape_string, pdo considered best mysql_escape_string considered adequate if meticulous. don't think ready go pdo or prepared statements have lot of complicated queries involving multiple tables huge task. want make use of mysql_escape_string more programmatic. rather escape every individual variable users submit, thinking of escape sql commands standard function might require modification handle punctuation sound approach or escaping whole query create problems-i use apostrophes, backticks , %, example. seem standard function every sql statement more systematic , standard variable variable approach. question modifications handle punctuation might needed? also, there else ought go function such htmlspecialchars , strip_tags gather mysql_escape_string not 100% complete? here basic function. function safe($sql) { $safesql = mysql_r...
