I get the point you’re trying to make, but the blame doesn’t really lay with php. Like most things introduced in early php, the mysql extension was just wrappi

I get the point you’re trying to make, but the blame doesn’t really lay with php. Like most things introduced in early php, the mysql extension was just wrapping c functions. The concept of “real” escape comes from mysqls’ C API: https://dev.mysql.com/doc/c-api/5.6/en/mysql-real-escape-string.html https://dev.mysql.com/doc/c-api/5.6/en/mysql-real-escape-str...