CODEWITHSUNDEEP
phpsecuritypdo
Chatoxz
Chatoxz

Reputation: 141

PDO execution and bindparam

If i do this:

$qry->execute(array($usuario,$pass));

instead of this:

$qry->bindParam(1, $usuario);
$qry->bindParam(2, $pass);
$qry->execute();

does this give a security problem?

Upvotes: 0

Views: 465

Answers (2)

Paul Dessert
Paul Dessert

Reputation: 6389

No, it will not. It will work fine.

Upvotes: 0

zerkms
zerkms

Reputation: 255005

Nope, they are semantically identical

And it's specified in the documentation

Execute the prepared statement. If the prepared statement included parameter markers, you must either:

  • call PDOStatement::bindParam() to bind PHP variables to the parameter markers: bound variables pass their value as input and receive the output value, if any, of their associated parameter markers

  • or pass an array of input-only parameter values

Upvotes: 6

Related Questions