[Solved] plain mysql prepare statement prevent injection attack?
[I assume that you meant $mysqli is mysqli connection.] Although the execution of stmt1 (the last of your three queries) is safe, the multi-query function you wrote is very unsafe. Running something like userQuery(“‘; delete from user; select * from user where username=””); will actually delete all users from your user table. Assuming $username represents … Read more