mysql_real_escape_string

PHP
1 
$query="select id from myTable1 where title='".$_POST['myVar']."' " ;

The code above works fine.

And the code below also works fine.

$title = mysql_real_escape_string($_POST['myVar']);
$query="select id from myTable1 where title='".$_POST['myVar']."' " ;

What’s the meaning of "$title = mysql_real_escape_string($_POST[‘myVar’]); "?
How does it prevent SQL injection?

2

[B]Read the manual!!!

[/B]1. Go to php.net
2. Type “mysql_real_escape_string” in the search box in the top right.
3. Read and you will learn.

3

I’ll give you the link

RTFM (Read This For More)

yesterday you mentioned that language is a barrier to reading the manual, but there is a wide range of languages you can choose from to view the manual.

also, some examples of sql injection

4

Thank you for your kind suggestion to the link although I already found the link by Raffles guide.

language is one of the barriers.

5

Korean: http://docs.php.net/manual/kr/function.mysql-real-escape-string.php