Manual escaping in Doctrine
doctrine, security, sql
Solution
When `mysql_real_escape_string()` is used properly it works great. Parameterized libraries like ADODB and PDO would not work without it. I strongly recommend using PDO.
Problem
When you're writing native SQL statements with Doctrine, how are you supposed to escape input? In my experience, `mysql_real_escape_string` doesn't work.