--- title: "Are PDO prepared statements sufficient to prevent SQL injection?" description: "Are PDO prepared statements sufficient to prevent SQL injection?" author: "Anonymous User" published: 2013-04-17 updated: 2013-04-17 canonical: https://www.mindstick.com/forum/776/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection category: "php" tags: ["php"] reading_time: 2 minutes --- # Are PDO prepared statements sufficient to prevent SQL injection? Hi All!\ Let's say I have code like this:\ $dbh = new PDO("blahblah");\ $stmt = $dbh->[prepare](https://www.mindstick.com/blog/12710/ibm-c1000-019-2019-march-exam-questions-are-out-download-and-prepare)('SELECT * FROM users where [username](https://www.mindstick.com/forum/12798/there-is-no-viewdata-item-of-type-ienumerable-selectlistitem-that-has-the-key-username) = :username');$stmt->[execute](https://www.mindstick.com/interview/49/how-can-i-execute-a-php-script-using-command-line)( array(':username' => $_REQUEST['username']) );The PDO [documentation](https://answers.mindstick.com/qa/30462/what-is-documentation) says\ The [parameters](https://www.mindstick.com/articles/87/passing-parameters-in-c-sharp) to prepared statements don't need to be quoted; the driver handles it for you.\ Is that truly all I need to do to [avoid SQL](https://www.mindstick.com/forum/295/avoid-sql-injection-attack) injections? Is it really that easy?\ You can assume MySQL if it makes a difference. Also, I'm really only curious about the use of prepared statements [against](https://yourviews.mindstick.com/view/81332/the-approach-of-science-against-disease-epidemics) [SQL injection](https://www.mindstick.com/blog/227/sql-injection). In this [context](https://www.mindstick.com/forum/23245/what-is-context-in-android), I don't care about XSS or other possible vulnerabilities.\ Thanks in [advance](https://www.mindstick.com/blog/33258/jee-mains-and-jee-advance-exams)! ## Replies ### Reply by AVADHESH PATEL Hi Lois!\ Prepared statements / parameterized queries are sufficient to prevent 1st order injection on that statement. If you use un-checked dynamic sql anywhere else in your \ application you are still vulnerable to 2nd order injection.\ 2nd order injection means data has been cycled through the database once before being included in a query, and is much harder to pull off. AFAIK, you almost never see \ real 2nd order attacks, as it usually easier to social-engineer your way in.\ One way to accomplish a 2nd order injection attack is when a value stored in a database is then used as a literal in a query. This isn't the best example, because it \ could still be stopped by a prepared statement, but the concept still applies.\ Let's say you put this value in a text box that's expecting a name (assuming MySQL DB for this question):\ ' + (SELECT UserName + '_' + Password FROM Users LIMIT 1) + 'A prepared statement will make sure that select query doesn't run at the time of insert, and store the value correctly in the database. But if later on the name is \ retrieved and then used a literal in another query you'll get to see someone else's password. And since the first few names in users table tend to be admins, you may \ have just given away the farm. (Also note: this is one more reason not to store passwords in plain text!)\ Again, this particular example isn't that great, but I try not to spend too much time thinking up real attacks, and even if I did I wouldn't post it straight up in public.\ --- Original Source: https://www.mindstick.com/forum/776/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.