title: Base64 encoded string for simple sql injection
body: <p><strong>Except performance issue, is base64_encode() a "good" practice to prevent SQL injection?</strong></p>
  
  <p>Of course not for all fields (columns) but just for one TEXT field (Example: in a contact form)</p>
  
  <p>We know that characters returned by base64_encode() function are "safe" and not need even escape (correct me if I'm wrong) but I want to know if it's "safe" in every situation (charset encoding, or something similar ).</p>
  
  <p>Simple practical example:</p>
  
  <pre><code>$dbc = new mysqli( DBHOSTNAME, DBUSERNAME, DBPASSWORD );
  
  $name = preg_replace( "#[^A-Za-z0-9@_]#", "", $_POST[ "name" ] );
  
  $phone = preg_replace( "#[^0-9 +]#", "", $_POST[ "phone" ] );
  
  /*
  Assuming this function check and sanitize a valid email
  */ 
  $email = is_email( $_POST[ "email" ] );
  
  $dbc-&gt;query( "INSERT INTO `testdb`.`testtable` 
  ( `name`, `email`,`phone`,`message` )
  VALUES ( '$name', '$email', '$phone', '" . base64_encode( $_POST[ "message" ] ) . "' )" );
  </code></pre>
  
  <p>In other hand prepared statement:</p>
  
  <pre><code>$dbc = new mysqli( DBHOSTNAME, DBUSERNAME, DBPASSWORD );
  
  $name = preg_replace( "#[^A-Za-z0-9@_]#", "", $_POST[ "name" ] );
  $phone = preg_replace( "#[^0-9 +]#", "", $_POST[ "phone" ] );
  
  /*
  Assuming this function check and sanitize a valid email
  */ 
  $email = is_email( $_POST[ "email" ] );
  
  $stmt = $dbc-&gt;prepare( " INSERT INTO `testdb`.`testtable` 
  ( `name`, `email `phone`, `message` )
  VALUES( '$name', '$email', '$phone', ? ) " );
  
  $stmt-&gt;bind_param( 's', $_POST[ "message" ] );
  $stmt-&gt;execute();
  </code></pre>
  
  <p>We have to deal with every kinds of hacking and injection techniques every day.</p>
  
  <p>Logically PDO or mysqli (<strong>with prepared statement</strong>) are safe, but in my case the output (message) will converted anyway in base64 (Required by other parts of project) so why not converting before storing (well some extra space on database)</p>