When writing GET parameters in MySQL, do I need to escape some characters to prevent arbitrary code from executing?

Question

PHP

When writing the desired parameters from the $_GET and $_POST arrays (that is, any value) to MySQL tables, do I need to use some kind of escaping functions, such as mysql_escape_string or addslashes, to prevent arbitrary code from executing?

Answer 1

do I need to use some kind of escaping functions like mysql_escape_string or addslashes to prevent arbitrary code from executing?

No, this is outdated and already incorrect information. Just give your parameters when substituting values ​​in a prepared statement, and everything will be safe.

Answer 2

from $_GET and $_POST arrays (i.e. any value)

Actually, there are other arrays besides $_GET and $_POST. and not arrays. $_GET and $_POST do not pull on the source of "any" value, it is not clear why these two are so honored.
and this is complete nonsense. I'll give a dozen offhand examples where "escaping functions" won't prevent anything at all. And all why? Because the purpose of these functions is completely different, it has nothing to do with code execution protection.
To protect against code execution, any variables must enter the request through a placeholder.