php - What characters are NOT escaped with a mysqli prepared statement? -

I am trying to harden some of my PHP code and better validate user input and injection attacks Using mysqli ready statement to stop.

I stopped by mysqli_real_escape_string However, when I prepare my query as a spicy statement, the same flaw is still present. The query has pulled the salt value based on the user's name, I do something for the password and other lookups.

Code:

  $ db = new sitedatalayer (); If ($ stmt = $ db-> _conn- & gt; Ready (like "Username" WHERE from "SELECT` salt 'administrator? LIMIT 1")) {$ stmt-> Bind_param ('s', $ username); $ Stmt- & gt; Executed (); $ Stmt- & gt; Bind_result ($ salt); While ($ stmt-> fetch ()) {printf ("% s \ n", $ salt); } $ Stmt- & gt; Close (); } And false return;  

• Am I writing the statement correctly?
• If I am then other characters should be examined? What are the other flaws?
• What is the best practice to do these types of selection?

Thanks,

% There is an underlying harmful character.

The question is: Do you like a in the first place ? Do not require exact matching for the user name in any circumstances?

The query must be:

  select 'salt' from admin Where `username '=? In that case, if I wanted to enter % owner  then my username must be (literally) "% sick", so that you can find a match.