Question: Is it safe to use this code ?

```
$check = mysql_query("SELECT id FROM table WHERE nick='asd'");
$count = mysql_num_rows($check);

```

I just need number of rows. id is AUTO\_INCREMENT

Answer: 
If 'asd' is a constant and not related to any (user) input, then yes it is safe.

Otherwise you should replace it with bind a variable and use prepared statements or at least escape it properly. (But it is easy to forget escaping, so it is a better practice to try to use bind variables instead.)
NO. Absolutely not.

First of all, read up on [MySQLi](http://nl1.php.net/mysqli). The i stands for improved. Secondly, use prepared statements. This prevents injection. Read up on that [here](http://codular.com/php-mysqli).

```
$db = new mysqli("localhost", "DATABASE-NAME", "DATABASE-USER", "DATABASE-PASS");
$check = $db->prepare("SELECT `id` FROM `table` WHERE `nick` = ?");
$check->bind_param('s', $nickVar);
$check->execute();

```

Don't take the easy way out. Keep doing things safe until it comes naturally. I used to be all about quick hacks, quickly get it to work, quickly write some things down, but in the end, it's best to get used to good practice.