title: PHP and SQL Server, how to make it secure?
body: <p><a href="http://www.php.net/manual/en/book.mssql.php" rel="nofollow">http://www.php.net/manual/en/book.mssql.php</a></p>
  
  <p>I am using that to connect from a LAMP environment to SQL Server. I noticed I don't have the neet functions like prepared statement and real_escape_string.</p>
  
  <p>How can I make my query as secure as possible? Any help is appreciated.</p>
  
  <p>Don't suggest me to use ODBC or PDO, I don't have that option. I have to run with what I have, and that's MSSQL.</p>
  
  <pre><code>$con = mssql_connect ('xxx', 'xxx', 'xxx');
  
  mssql_select_db('xxx', $con);
  
  $qry = "SELECT 
              firstname
      FROM 
              person
      where firstname = '{$firstname}'";
  
  $query = mssql_query($qry, $con);
  </code></pre>