The string $title is expected only to be lowercase alpha-numeric or the symbol "-" .

In this situation which of the following methods is efficient defense against security vulnerability?

```
$title=$_GET["title"];
$title = strtolower(preg_replace("/[^a-z0-9\-]+/i", "-", $title));
< mysql query using $title goes here >

```

OR

```
$title=$_GET["title"];
$title = mysql_real_escape_string($title);
< mysql query using $title goes here >

```