No fuck both of those, just use prepared statements so user input can't be interpreted as SQL.
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
No fuck both of those, just use prepared statements so user input can't be interpreted as SQL.