injection. For MySQL, the mysql_real_escape_string() API function is available in both
C and PHP.
Assume all input is malicious. Use an "accept known good" input validation strategy,
i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any