http://maverick.i2p/blog/darknet-dev
You still validate types, constrain formats, and most importantly run the database account with least privilege so if injection lands, the damage surface is strangled instead of catastrophic. In PHP, the old mysql_ functions are dead. Use PDO with prepared statements. Never concatenate variables into the query string. PHP // Disable emulation. $ pdo -> setAttribute ( PDO :: ATTR_EMULATE_PREPARES , false ) ; $ stmt = $ pdo -> prepare ( "...