title: Sanitizing query, escape characters, query mysqli_real_escape_string
body: <p>I have recently begun learning and practicing PHP/MySQL and wrote a comment/note system. I am having trouble sanitizing the input, escape characters.</p>
  
  <pre><code>    &lt;?php
  include($_SERVER['DOCUMENT_ROOT'].'/includes/dbh.php');
  $newNote = mysqli_real_escape_string($conn, $_POST['note']);
  
  if (empty($newNote)){
          header("Location: /admin/notes.php?error=empty");
          exit();
  } else {
          $dt = date('M d, Y ');
          $sql = "INSERT INTO notes (dt, note) VALUES ('$dt', '$newNote')";
          $result = mysqli_query($conn, $sql);
          header("Location: /admin/notes.php?success");
      }
  ?&gt;
  </code></pre>
  
  <p>Do I want to be sanitizing the $result variable or the $sql variable? I had this working properly earlier before changed were made and I am somewhat certain the $newNote variable is still sanitizing properly. I'd like to be certain.</p>
  
  <p>$sql is just setting the stage, not doing anything and when $result is run that is when the query happens. So I would want to sanitize before the query.</p>
  
  <p>Should I research PDO and drop mysqli?</p>