phpeveryday.com

SQL injection is one thing that get concern by PHP programmer. Target SQL injection is sensitive part in web application, database. An experienced attacker can use this hacking technique to access sensitive data. It use strings contain query that will be executed by database. It may be can display, modify, or delete your data.

The easiest way to escape from this attack is using mysql_real_escape_string(). By escaping special characters on fields where the user can manipulate the database, you will avoid being vulnerable.

The following code is unsecure example:

$query = "SELECT * FROM students WHERE name='$name'";
mysql_query($query);

I think following code more secure:

$query = sprintf("SELECT * FROM students WHERE name='%s'",
mysql_real_escape_string($name));
mysql_query($query);