forum

Home / DeveloperSection / Forums / Are PDO prepared statements sufficient to prevent SQL injection?

Are PDO prepared statements sufficient to prevent SQL injection?

Anonymous User316917-Apr-2013
Hi All!

Let's say I have code like this:

$dbh = new PDO("blahblah");

$stmt = $dbh->prepare('SELECT * FROM users where username = :username');
$stmt->execute( array(':username' => $_REQUEST['username']) );
The PDO documentation says

The parameters to prepared statements don't need to be quoted; the driver handles it for you.

Is that truly all I need to do to avoid SQL injections? Is it really that easy?

You can assume MySQL if it makes a difference. Also, I'm really only curious about the use of prepared statements against SQL injection. In this context, I don't care about XSS or other possible vulnerabilities.

Thanks in advance! 

Updated on 17-Apr-2013
I am a content writter !

Can you answer this question?


Answer

1 Answers

Liked By