Mysql_real_escape_string () for $ _SESSION variables?

Question

Should I use a function mysql_real_escape_string()in my MySQL queries for variables $_SESSION? Theoretically, variables $_SESSIONcannot be changed by the end user, unlike variables $_GETor $_POST??

Thanks:)

Answer 1

Regardless of whether the user can modify the data, you probably want to avoid it if you ever need information to contain characters that could break SQL (quotation marks, etc.).

Better yet, use the related options and you won’t have to worry about it.

Answer 2

// , . "".

Answer 3

You can answer the question yourself by following this line of reasoning:

Does the value in $ _SESSION mean from user input?

If so, has he already passed the scan?

Answer 4

Theoretically, $ _SESSION variables cannot be changed by the end user

No, but the data should have come from somewhere.

You should avoid any exit from PHP by using the appopriate method for the recipient the moment he leaves PHP.

FROM.