php - Do I need mysqli->real_escape_string after filter url? -

i'm asking question because i'm still not quite sure if filter $_get variable enough prevent mysql injection, @ first have filter function

function filter_url($url) {   if (is_array($url))   {     foreach ($url $key => $value)     {       // recurssion       $url[$key] = filter_url($value);     }     return $url;   }   else   {     // remove except a-za-z0-9_.-&=     $url = preg_replace('/[^a-za-z0-9_\.\-&=]/', '', $url);     return $url;   } } 

i have $_get=filter_url($_get); everytime before call

$filter_case =isset($_get['product_id'])?"and product_id={$_get['product_id']}":""; 

do need $mysqli->real_escape_string($_get['product_id']) ? if still have imply it, kind of sql injection overpass query method?

besides, important $mysqli->real_escape_string($_session['member_id']) i'm thinking of possible manipulate $_session variable?

this wrong question ask.

you need $mysqli->real_escape_string when adding string literal sql query. in such case need function regardless of whatever string source or validation. in other case (ie string goes not in query or not sql string) function going absolutely useless.

this why essential use prepared statements, either native or emulated.