Which is the strongest defence against SQL injection in PHP?
- A mysqli_real_escape_string on every value
- B Prepared statements with bound parameters
- C Removing quotes from input
- D Limiting input length
Answer
Prepared statements with bound parameters
Prepared statements send the query structure separately from values, so input can never be parsed as SQL. Escaping is fragile by comparison.





