I'm trying to figure out the difference between using prepared statements and and escaping/converting a variable into a string as follows:  $sql = "SELECT `user_id`, `user_name` FROM table WHERE `user_id` = ? and `user_name`= ?"; $sqlPrepare = $conn-&gt;prepare($sql); $sqlPrepare-&gt;bind_param('ss', $user_id, $user_name); $sqlPrepare-&gt;execute(); $result = $ $sqlPrepare-&gt;get_result();             if($result-&gt;num_rows ===0)                          {                         // Do work                          }   VS  mysqli::real_escape_string($whatever_vars_needed);  $sql = "SELECT `user_id`, `user_name` FROM table WHERE `user_id` = '".$user_id."' and `user_name`= '".$user_name."'"; $sqlQuery = $conn-&gt;query($sql);     if($sqlQuery-&gt;num_rows ===0)                          {                         // Do work                          }   as far as protecting against sql injections go, would they both serve the same purpose? And if so, wouldn't it be preferred to use the second method since it does save a bit of extra typing?  I realize that I'm using query vs prepare but even then I don't really see the difference if I'm converting the variables into strings?  Which is a better method?
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
Does an ability or spell grant me the bonus action with which to use it? The  description of casting times says that spells with a casting time of &quot;bonus action&quot; require a bonus action to cast (p. 79, emphasis mine):  Most spells require a single action to cast, but some spells require a bonus action, a reaction, or much more time to cast. Bonus Action A spell cast with a bonus action is especially swift. You must use a bonus action on your turn to cast the spell, provided that you haven't already taken a bonus action this turn. You can't cast another spell during the same turn, except for a cantrip with a casting time of 1 action.  It's pretty clear that bonus actions aren't automatic (p. 69):  You can take a bonus action only when a special ability, spell, or other feature of the game states that you can do something as a bonus action. You otherwise don't have a bonus action to take.  So to cast a spell like Healing Word (p. 93), do I  need to be granted a bonus action that I can use, or do I have a bonus action I can use?  I guess I'm unclear on whether I need to have a bonus action before I can spend it on something, or whether having an ability, spell, or whatnot that can be done as a bonus action grants me the bonus action I need to use it. How to ensure that string interpolated into `sed` substitution escapes all metachars I have a script that reads a text stream and generates a file of sed commands that is later run with sed -f. The generated sed commands are like:  s/cid:image002\.gif@01CC3D46\.926E77E0/https:\/\/mysite.com\/files\/1922/g s/cid:image003\.gif@01CC3D46\.926E77E0/https:\/\/mysite.com\/files\/1923/g s/cid:image004\.jpg@01CC3D46\.926E77E0/https:\/\/mysite.com\/files\/1924/g   Assume the script which generates the sed commands is something like:  while read cid fileid do     cidpat="$(echo $cid | sed -e s/\\./\\\\./g)"     echo 's/'"$cidpat"'/https:\/\/mysite.com\/files\/'"$fileid"'/g' &gt;&gt; sedscr done   How can I improve the script to ensure all regex metacharacters in the cid string are escaped and interpolated properly? Illustrator: Is there an efficient and accurate way to join two circles by their tangents (and keep it editable)? It's easy to join two circles if they are the same size and horizontal/vertical, into a pill shape:    If the circles are at an add angle then it's still possible but you can no longer rely on smart guides.     You can add lines roughly where the tangents should be and then use the scissors tool on the circles, cut out the inner area and then join the two crescents into one shape.    Is there a better way to do this? Is there a way to do this that is still editable afterwards too?  There are some other questions that cover the same area as this but don't cover editability or joining circles that are not in line with each other (where smart guides can't help). Notation question: $\ll$ Google Maps API v3, jQuery UI Tabs, map not resizing I am a economics major undergraduate student who will apply for grad schools in the coming semester. I think I have quite a strong research experience in mathematical statistics (asymptotic statistics to be specific), but, unfortunately, not much in economics itself. So I am curious if economics departments in graduate schools will care about my research experience in statistics?  Maybe a broader question is if grad schools care about applicants' research experience in a different (maybe even unrelated) field at all? I guess in my case statistics and economics are still quite correlated, but what about other more distant combinations of target departments and previous research experience? How to print the position How to write the below lines using array?? val1=$(grep 'Thread' Threadout.txt | awk -F&quot;/&quot; '{print $1}')    val2=$(grep 'Thread' Threadout.txt | awk -F&quot;/&quot; '{print $2}')  val3=$(grep 'Thread' Threadout.txt | awk -F&quot;/&quot; '{print $3}')  val4=$(grep 'Thread' Threadout.txt | awk -F&quot;/&quot; '{print $4}')  Threadout.txt contains like &quot;Thread 1/1/25/100&quot; I'll be arriving at Heathrow in June 2015 with my current girlfriend for a holiday in the UK. I've been trying to find out which immigration queue to join at Heathrow Passport Control without much luck. I have a British passport, my girlfriend has a non-EU passport.     Should I join the EU queue and she the non-EU queue or should we both queue together (and if so, which of the queues should we join)? "I saw him crossing" vs. "I saw him cross" I saw him crossing the road.   I saw him cross the road.   Which one is correct and why? How do I create an invisible character? I cannot remember how to create an invisible character in LaTeX, i.e. I want to put a space that has the width of a particular character, say `M'. I know there is a command for this, and this is a really dumb question, but my Google-fu has failed me. How loud/obvious is a wizard casting a spell? Some spells have somatic and vocal components, that's well known.  How loud must a wizard talk? How obvious/wide should his gestures be?  Some spells that would be awesome would be fairly limited if you need to shout them (ex: mage hand, range 30ft). Can we have some tools to handle link rot? There are many links posted in answers, and some in questions, that are either stale or broken.  An example is the change to  on-line documentation this year to do away with separate 'Optional' and 'Core' tasks areas in the documentation - the old links 404 now.  I've fixed a bunch of 'optionaltasks' broken links, but searching for 'coretasks' in Stack&nbsp;Overflow questions returns over 300 matches...  Are there any tools for us to review and fix these - with an emphasis on the fixing - without sifting through completely manually?  Is it time for some refactoring tools for Stack&nbsp;Overflow content, in particular, for links?  Also, I'd be interested to know if there is an analysis of links (as found in the Stack&nbsp;Overflow data dumps) out there. Answer: there is a  of a sample of links and images, but it's getting a bit out-of-date. How to prove that $\frac{(mn)!}{m!(n!)^m}$ is an integer? $\forall m,n\in\mathbb Z$ , $m\ge1$ and $n\ge1$ how to prove that  $$\frac{(mn)!}{m!(n!)^m}$$ is an integer?  Thanks in advance. I am wondering if there is away (possibly a better way) to order by the order of the values in an IN() clause.  The problem is that I have 2 queries, one that gets all of the IDs and the second that retrieves all the information. The first creates the order of the IDs which I want the second to order by. The IDs are put in an IN() clause in the correct order.  So it'd be something like (extremely simplified):  SELECT id FROM table1 WHERE ... ORDER BY display_order, name  SELECT name, description, ... WHERE id IN ([id's from first])   The issue is that the second query does not return the results in the same order that the IDs are put into the IN() clause.  One solution I have found is to put all of the IDs into a temp table with an auto incrementing field which is then joined into the second query.  Is there a better option?  Note: As the first query is run "by the user" and the second is run in a background process, there is no way to combine the 2 into 1 query using sub queries.  I am using MySQL, but I'm thinking it might be useful to have it noted what options there are for other DBs as well. I have a group of objects of the same colour, consisting of compound paths, regular paths and groups of these. How to change the colour of all objects at once? When I tried to use colour picker or change it through color palette the colour remained the same but the graphics was rendered with a very tiny outline of the new colour, which I guess is not printable. Usually I had to change the colour of all objects individually.  Edit: I'm sorry if I was not too precise. I mean to apply new colour / swatch to all member objects of the group at once, not to change properties of a commonly shared swatch.    Edit 2: I received very useful answers, however my goal was to pick a colour from another object, serving as a source. When I tried to select all objects, for example with ctrl-a, and then use a eyedropper to pick up a desired colour, it didn't work for some objects in some groups. Please have a look at my answer where several methods are listed. Duplicate flag lists "you have already raised this flag" after flagging as "Unclear what you're asking" \bordermatrix with brackets [ ] instead of parentheses ( ) I have the following code:  \documentclass{article} \begin{document} $ M = \bordermatrix{~ &amp; x &amp; y \cr               A &amp; 1 &amp; 0 \cr               B &amp; 0 &amp; 1 \cr} $ \end{document}   But this code makes a matrix with () and i would like it to be with [] How do i do this? Word for "the entire back part of the body"? When we lie down, the "back part of the body" is in contact with the bed. It includes the heels, the calves, the backside, the back, and the back of the neck, and the back of the head etc.  How do we refer to the entire "back part" of the body? Large text files load not working on android Can I load a 32 bit DLL into a 64 bit process on Windows?