Is this code resistant against injection? I already used 'real-escape-string' but I don't know if this good enough. As you see I replaced my personal info. And the code does work. I'm building this site for a family member so it needs to be very protected against 'hackers'. Thank you in advance.
HTML:
<input type="text" name="email" id="email">
<div id="sub" class="button"> Subscribe </div>
<div id="unsub" class="button"> Unsubscribe </div>
<div id="answer"></div>
PHP:
$conn = new mysqli('#', '#', '#', '#');
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$email = $_POST['email'];
$sql = sprintf("SELECT * FROM ... WHERE email = '%s'", mysql_real_escape_string($email));
$result = $conn->query($sql);
if ($result->num_rows > 0) {
die ("Already subscribed");
} else {
$sql2 = sprintf("INSERT INTO ... (email) VALUES ('%s')", mysql_real_escape_string($email));
$result2 = $conn->query($sql2);
echo "You subscribed!";
}