CODEWITHSUNDEEP
phpmysqlpdosanitization
user796443
user796443

Reputation:

Using PDO without binding

$stmt = $conn->prepare('SELECT * FROM users WHERE user_id = :user_id');

$stmt->execute(array(':user_id' => $_GET['user_id']));

$result = $stmt->fetchAll(PDO::FETCH_OBJ);

I'm using PDO like that, do I need to sanitise GET parameter?

I know if I do $stmt->bindParam(':user_id', $_GET['user_id'], PDO::PARAM_INT); than it is not a problem. But is my way safe?

Upvotes: 5

Views: 728

Answers (1)

deceze
deceze

Reputation: 522382

Yes, it's safe. The only differences between execute and bind* are:

  • execute accepts several parameters at once, while you have to bind* each one individually
  • bind* allows you to specify the parameter type, while execute binds everything as strings

Passing parameters to execute is mostly a convenience shorthand, it's still safe.

Upvotes: 9

Related Questions