title: Quick MySQLi security question
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/2284317/do-i-have-to-use-mysql-real-escape-string-if-i-bind-parameters">Do I have to use mysql_real_escape_string if I bind parameters?</a>  </p>
  </blockquote>
  
  
  
  <p>I have a quick MySQLi security related question...</p>
  
  <p>For example, take a look at this code (gets input from the user, checks it against the database to see if the username/password combination exist):</p>
  
  <pre><code>$input['user'] = htmlentities($_POST['username'], ENT_QUOTES);
  $input['pass'] = htmlentities($_POST['password'], ENT_QUOTES);
  
  // query db
  if ($stmt = $mysqli-&gt;prepare("SELECT * FROM members WHERE username=? AND password = ?"))
  {
      $stmt-&gt;bind_param("ss", $input['user'], md5($input['pass'] . $config['salt']));
      $stmt-&gt;execute();
      $stmt-&gt;store_result();
  
      // check if there is a match in the database for the user/password combination
      if ($stmt-&gt;num_rows &gt; 0)
      {}
  }
  </code></pre>
  
  <p>In this case, I am using htmlentities() on the form data, and using a MySQLi prepared statement. Do I still need to be using mysql_real_escape_string()?</p>