Please tell me if quotes protect from sql injections. I have such codes

mysqli_query($link, "SELECT `kredits` FROM `users` WHERE `mail` = '$mail' AND `password` = '$pass'"); mysqli_query($link, "INSERT INTO `vivod` (`summa`, `email`) VALUES ('$zsum', '$summal')");

Are they protected from sql injection? And if not, can mysqli_real_escape_string protect?

1 answer 1

No, do not protect. Try this:

 $db = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME); //тут свои данные подставь $stmt = $this->db->prepare("SELECT `kredits` FROM `users` WHERE `mail` = ? AND `password` = ?"); $stmt->bind_param('ss', $email, $password); //s-string $stmt->execute();

Well, here's the documentation