2

Would this protect my INSERT from SQL Injections? and can I somehow shorten this code to make it look neater?

$db = new PDO('mysql:host=XXXXXXXXXX;dbname=XXXXXXXXX', 'XXXXXXXXX', 'XXXXXXXXXX');

// query MySQL to verify login
$query = $db->prepare("INSERT INTO login (username,password,name,email_add,age,country) VALUES (:username,:password,:name,:email_add,:age,:country)");
$query->execute(array(
':username' => $username, 
':password' => $password,
':name' => $name,
':email_add' => $email,
':age' => $age,
':country' => $country));
3
  • 1
    We definitely need a reference answer that reads in all caps "yes it does". Jun 17, 2013 at 7:25
  • You can't actually accept two. But the point is different anyway. Jun 17, 2013 at 7:28
  • Oh, thought I could, because I have seen double up before. However, thank you for letting us know, Starx has edited his post!
    – user1817311
    Jun 17, 2013 at 7:31

1 Answer 1

0

YES, PDO Extension already removes all the injection vulnerabilities like that. Since you are binding params afters ward, you are doing it correctly too.

However, just to make the query at it safest state, specify the data type of the variable while binding them.

$query = $db->prepare('INSERT INTO login (username,password,name,email_add,age,country) VALUES (:username,:password,:name,:email_add,:age,:country)');

$query->bindParam(':username', $username, PDO::PARAM_STR, 20);
// and so on
$query -> execute();

More Details

6
  • Do you have an example of how I can specify the data type? Thank you for the feedback so quick.
    – user1817311
    Jun 17, 2013 at 7:23
  • @FriedBitz, I was updating my answer. Please check again.
    – Starx
    Jun 17, 2013 at 7:24
  • So how do I make it execute as an array or is that a function that is built in when you use BindParam?
    – user1817311
    Jun 17, 2013 at 7:26
  • @FriedBitz, Simply as $query -> execute() I have updated my answer again.
    – Starx
    Jun 17, 2013 at 7:28
  • Okai, thank you! I will accept answer when cooldown time is finished. In the meantime, would I put the age as a string aswell?
    – user1817311
    Jun 17, 2013 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.