CODEWITHSUNDEEP
phpmysqlpdo
user2397380
user2397380

Reputation: 31

sql statements and pdo

There is a pdo wrapper class that has turns off emulation or prepared statements using:

setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

I am seeing where some of the sql statements are written using standard non parameterized methods such as seen below:

select * from table where name = '".$name."'.

Are these kind of statements protected against sql injections even though a pdo wrapper is employed?

Upvotes: 1

Views: 63

Answers (1)

Your Common Sense
Your Common Sense

Reputation: 157991

Your idea of protecting from injections is quite wrong.

It is not PDO just by it's presence (which can be interfered by some wrapper) protects your queries, but prepared statements.

As long as you are using prepared statements, your queries are safe, no matter if it's PDO or wrapper, or even poor old mysql ext.

But if you are putting your data in the query directly, like in your example, there is no protection at all

Upvotes: 3

Related Questions