[ReshiramZekrom]

Hi.

How to prevent Mysql Injection?

I have to use mysql_escape_string() or I can simply do something like this:

PHP код:

format(Query, sizeof(Query), "SELECT * FROM `users` WHERE `Nome` = '%e'", name); 


Thank you for the help

[Stinged]

Use %e with mysql_format, %q with format.

[ReshiramZekrom]

Quote:

Originally Posted by Stinged Use %e with mysql_format, %q with format.

Using mysql_escape_string() it's the same thing of using %q instead of %s, right?