You can use prepared statements using mysqli.
In addition, there is a function for storing large (blob) data that the "old" mysql extension does not have.
$mysqli = new mysqli('localhost', 'localonly', 'localonly');
if ($mysqli->connect_error) {
die($mysqli->connect_error);
}
$stmt = $mysqli->prepare("INSERT INTO foo (mydata) VALUES (?)");
$stmt->bind_param("b", $null);
$fp = fopen("php://input", "r");
while (!feof($fp)) {
$chunk = fread($fp, 4096);
$stmt->send_long_data(0, $chunk);
}
$stmt->execute();
source
share