title: Prevent SQL injection in PHP
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/574805/how-to-escape-strings-in-mssql-using-php">How to escape strings in MSSQL using PHP?</a>  </p>
  </blockquote>
  
  
  
  <p>I am making a system and I need to prevent SQL injection. I'm using PHP and SQL Server 2008 R2. Basically what I'm wondering is if I can just use:    </p>
  
  <pre><code>mysql_real_escape_string
  </code></pre>
  
  <p>or is there a specific one for SQL Server. Any feedback appreciated.</p>