Honestly, I wouldn't even suggest people try and escape their inputs. Just use parameters. They will be far more secure than attempting to escape and sanitize inputs.
I agree as well. I suggested using parameters/bindings. Hope you saw that in the article. Thank you for your comment.
I did see that, I was saying skip the first suggestion of sanitizing input, and just use the second suggestion. The first suggestion is just asking for trouble.
This advice doesn't sit right with me. I like to make sure my numbers don't contain chars. But that is about not breaking my data flow- not security.
Sure, I'm not talking about no validation or sanitation. I'm talking about as a security measure. Trust the far more secure parameters rather than thinking that escaping some quotes is going to protect you.
That's the purpose of validation. I think we was talking about sanitisation before storage. But I think that if there is a good validation, sanitisation is half taken care of. Sanitisation will still be indispensable even if one is using parameter bindings or prepared statements.