CODEWITHSUNDEEP
php
Lukas
Lukas

Reputation: 169

Is it needed to filter/sanitize input if prepared statements are used?

Is it needed to filter/sanitize input if prepared statements are used or is it enough to sanitize/filter it on output? If the prepared statements are used the input cannot "hurt" only the output can which will be always sanitized and filtered.

Upvotes: 1

Views: 334

Answers (1)

Vilx-
Vilx-

Reputation: 106970

If you put EVERYTHING that comes from the user into a parameter, then, no, don't sanitize it. A parameter is automatically sanitized. If however you put something directly into an SQL string (concatenate strings), then, yes, you need to sanitize.

Upvotes: 3

Related Questions