How to guard against SQL injection in PHP?

[mikek12004]

Most of my previous project were done with MySQL so using mysql_real_esca pe_string() made me feel a little more secure. Is there any function like this for mssql in PHP?

[ck9663]

You have to parse your T-SQL before you send it to SQL Server. This makes it more a PHP question that a SQL Server. PHP gurus can help you more with this.


-- CK

[mikek12004]

I see...Sorry didn't think it when making the post ;)

[Dormilich]

you could use a Database Abstraction Layer like PDO or MDB2, which a) allow you to use your code with different data bases and b) allow you to use prepared statements (see SQL Injection @ Wikipedia).