I've seen a tutorial now explaining prepared statements but I've seen them do the same thing as mysqli_real_escape_string but it uses more lines
準備好的報表有什么好處嗎?您認為最好的方法是什么?
Are there any benefits for prepared statements?
What do you think is the best method to use?
推薦答案
準備好的語句.因為無處逃避是一回事.實際上，逃避與任何注射都沒有關系，不應該用于保護.
Prepared statements only. Because nowhere escaping is the same thing. In fact, escaping has absolutely nothing to do with whatever injections, and shouldn't be used for protection.
雖然準備好的語句在適用時提供 100% 的安全性.
While prepared statements offer the 100% security when applicable.
