mysql - If PHP does not use PDO, how to prevent injection when constructing SQL statements?

Question

If PHP does not use PDO, how to prevent injection when constructing SQL statements?

Can formatting strings be eliminated?

Answer 1

Can’t.
Be sure to escape special characters such as quotation marks and backtick marks.
Be sure to pay attention to the encoding of the database.
Be sure to filter for special encodings in statements.
pdo uses database parameter binding, so injection is avoided.