SQL code which prevents sql injection attacks

[bolton]

Hi guys

Im trying to write some code which inserts values into the database and protects from sql injections.

So far I have:

$sql = "
	  INSERT INTO users (title,firstname,surname) 
	  VALUES 
	  (:title,:firstname,:surname)";
	$q = $conn->prepare($sql);
	$q->execute(
		array(
			':title' => $title,
			':firstname' => $firstname,
			':surname' => $surname
		)
	);

Will that do the job? Thanks

[Thallius]

Yes this is safe for SQLInjections.

If I remember right the statement name in the array is without the double point or?

[rpkamp]

Both with and without the colon work.

[bolton]

Ah great, thanks. So I dont have to bind it? I was reading a tutorial saying you had to bind the data after you prepare it, but another tutorial didnt mention the binding part, so I got confused.

[Thallius]

using the bindParam or bindValue functions is only another possibility.

[bolton]

Ah ok - thanks @Thallius !

[mabismad]

@bolton

a tutorial saying you had to bind the data after you prepare it, but another tutorial didnt mention the binding par

Explicit binding is NOT required, unless you are using long-blob-data or are using emulated prepared queries and you must tell php what data type to use when it’s not the default string data type.

In all other cases, simply use implicit binding, by supplying an array of data to the ->execute([…]) call.

[SamA74]

@bolton

I was reading a tutorial saying you had to bind the data

I don’t use mysqli, but I think you have to bind parameters using that.
In PDO there is no need to bind the parameters, so much simpler.