Is it necessary to use mysql_real_escape_string() for image into mysql?

Question

For example:

    $data = file_get_contents($_FILES['image']['tmp_name']);
    $data = mysql_real_escape_string($data);
    mysql_query("INSERT INTO table set image='$data'....

Is this a correct way to stick with?

Answer 1

You could do a base64_encode to keep the integrity of your data, and assure that you will not have problems with characters of any kind, actually it is a very common way to keep and transfer data. And to get it back use base64_decode .

Answer 2

I would recommend keeping it unless there is a reason to remove it, as its a good way to prevent sql injection. See here: http://php.net/manual/en/function.mysql-real-escape-string.php .

It is probably possible to do sql injection through an image that a user could upload or a client could accidentally use.

A reason not to use it could be performance. I would tend to recommend security over performance.