John works as a Professional Penetration Tester. He has been assigned a project to test the ='or''=' as a username and successfully logs on to the user page of the Web site. Now, John asks the we-are-

escapeshellarg() wraps a string for safe use in OS shell commands by escaping shell metacharacters, and provides no protection against SQL query manipulation.

session_regenerate_id() creates a new PHP session identifier to defend against session fixation attacks and has no bearing on SQL query construction or input sanitization.

The mysql_real_escape_string() function escapes characters such as single quotes, backslashes, and null bytes that are exploited in payloads like ='or''=', ensuring the input is treated as a literal string rather than executable SQL logic. By sanitizing user-supplied data before it is embedded in a query, the function eliminates the injection vector at the point where untrusted input meets the database layer.

escapeshellcmd() escapes metacharacters in shell commands to prevent OS command injection, not SQL injection, making it irrelevant to securing database queries.