StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POHow can mysqli_real_escape_string fail to prevent a SQL injection?
primarykey
Id
16315368
data
AcceptedAnswerId
16315399
AnswerCount
1
ClosedDate
2013-05-01T12:39:45.973
CommentCount
3
CommunityOwnedDate
CreationDate
2013-05-01T08:59:10.460
FavoriteCount
2
LastActivityDate
2013-05-01T09:23:50.583
LastEditDate
2013-05-01T09:05:46.157
LastEditorUserId
2338825
OwnerUserId
2338825
ParentId
0
PostTypeId
1
Score
7
ViewCount
2612
LastEditorDisplayName
text
Body
First of all, I get that people want to use stored procedures so that they reuse queries and have the escaping taken care of. However, I have read many developers say that <code>mysqli_real_escape_string</code> can not 100% prevent SQL injections. Can someone please provide an example of this? From my limited knowledge on the subject I would say that <code>mysqli_real_escape_string</code> would always be fine for strings but for numerical values you could be caught out unless you check the number is an int, float, double, etc. EDIT: I forgot to add something critical: assume that the charset is UTF8 and mysqli_set_charset has been called accordingly. The only injecting I've seen rely a handful of charsets (none of which are UTF8).
Tags
<php><mysql><mysqli>
Title
How can mysqli_real_escape_string fail to prevent a SQL injection?
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. UStexelate
UserOwnerUserId
1. UStexelate
plurals
PostLinksPostIdRelatedPostId
1. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
2. PL
 singulars
 LinkTypeLinkTypeId
 LTDuplicate
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POHow can mysqli_real_escape_string fail to prevent a SQL injection?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTClose
2. VO
 singulars
 PostPostId
 POHow can mysqli_real_escape_string fail to prevent a SQL injection?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
3. VO
 singulars
 PostPostId
 POHow can mysqli_real_escape_string fail to prevent a SQL injection?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.