# PHP / Mysql security question

**URL:** <https://forum.kirupa.com/t/php-mysql-security-question/298819>\
**Category:** programming\
**Created:** [October 26, 2009, 1:50am UTC](https://forum.kirupa.com/t/php-mysql-security-question/298819 "2009-10-26T01:50:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stubbs](https://avatars.discourse-cdn.com/v4/letter/s/2acd7d/32.png) [@Stubbs](https://forum.kirupa.com/u/Stubbs)\
**Post date:** [October 26, 2009, 1:50am UTC](https://forum.kirupa.com/t/php-mysql-security-question/298819/1 "2009-10-26T01:50:20Z")

</div>

This is pretty open ended, but generally, what do you guys do for mysql security? Will using “mysql\_real\_escape\_string” do the trick or are there other holes to plug? For example, do I need to worry about certain characters like “–” or “;”?

One piece of advice I received suggested only allowing strings into the database. If I have my table column labeled “VARCHAR” does this automatically make the conversion, or do I need to convert it with php before sending it to the database?

What methods do you guys use? Any comprehensive resources you can point me towards?

Thanks