Do "mysqli_stmt::bind_param" uses from "mysqli::real_escape_string" implicitly?

Question

Do mysqli_stmt::bind_param uses from mysqli::real_escape_string implicitly? Or we must do it manually?

score 1 · Accepted Answer · edited May 23 '17 at 11:56

Neither mysqli_stmt::bind_param does mysqli::real_escape_string implicitly, nor you have to do it manually.

First, escaping is not a synonym for safety. While binding is.
So, it's incomparable matters. Please refer to my earlier answer for the explanation: Properly Escaping with MySQLI | query over prepared statements

Next, bind_param doesn't use escaping anyway - it's different mechanism
Please refer to another my answer with full explanation: How prepared statements can protect from SQL injection attacks?

1 Answers1