Menu
Community /Pin to ProfileBookmark
@NogDogSep 29.2019 — #MySQLi does include prepared statements with bound parameters, which the old, deprecated MySQL extension did not. PDO has always included it -- but then it came along after the original MySQL extension did.
That being said, the fact that prepared statements exist in either does not automatically prevent SQL injection: it only does so if the developer actually uses it wherever applicable, and uses it correctly. All it takes is one lazy inclusion of an un-sanitized variable in your SQL, and it doesn't matter if you used the relevant
Here's a good place to start for some examples of PDO:https://www.php.net/manual/en/pdo.prepared-statements.php
PDO V Mysqli Prepared Statements
PHP Bros,
Is it true that Mysqli extension did not contain SQL injection proof communications with Mysql dB and so prepared statements was built ?
Is it true that when coding using the mysqli extension, you have to code using prepared statements method ?
And is it true that PDO was built with SQL injection proof method and so you do not need to use prepared statements method ?
If so, then using a basic PDO connection and Mysql dB communication command automatically creates an SQL injection proof connection ?
Do you mind showing 4 pfo code samples so I can learn from you ?
1. INSERT into dB tbl2. UPDATE row in dB tbl entry3. DELETE a certain row from dB tbl4. COPY certain row5. Connect to DB
You are welcome to provide any other code samples related to pdo dealing with dB.
Anything else I should know ?
Sign in
to post a comment3 Comments(s) ↴
0
@NogDogSep 29.2019 — #MySQLi does include prepared statements with bound parameters, which the old, deprecated MySQL extension did not. PDO has always included it -- but then it came along after the original MySQL extension did.That being said, the fact that prepared statements exist in either does not automatically prevent SQL injection: it only does so if the developer actually uses it wherever applicable, and uses it correctly. All it takes is one lazy inclusion of an un-sanitized variable in your SQL, and it doesn't matter if you used the relevant
prepare()execute()Here's a good place to start for some examples of PDO: