[Solved] How can I avoid SQL injection in my code below? [duplicate]
As suggested, prepared statements are the best way to achieve good protection from SQL injection. Shortened Example You will need to add entries to fill in all columns you wish to insert. $email = $_POST[‘e-mail’]; $fn = $_POST[‘firstname’]; $ln = $_POST[‘lastname’]; if ($stmt = $mysqli->prepare(“INSERT INTO `newcartdb`.`orders`(Email,Firstname,Lastname) values(?,?,?)”) { $stmt->bind_param(“sss”, $email, $fn, $ln); “sss” – … Read more