How to sanitize data in php in order to avoid SQL injection?

Question

I already used the PDO:

        $stmt = $aPDO->prepare("INSERT INTO ".$this->getM_oUser()->getM_sTableName()." (email, hash_pw, hash_key) VALUES (:email, :hash_pw, :hash_key)");                                             
        $stmt->bindValue(':email', $this->getM_oUser()->getM_sEmail());
        $stmt->bindValue(':hash_pw', $this->getM_oUser()->getM_sHash_pw());
        $stmt->bindValue(':hash_key', $this->getM_oUser()->getM_sHash_Key());

        $stmt->execute();

Should I also use mysql_real_escape_string() to handle the user input string? Thank you.

possible duplicate of Are PDO prepared statements sufficient to prevent SQL injection? — Haim Evgi
– Haim Evgi, Commented Aug 1, 2011 at 8:44

Jon · Accepted Answer · 2011-08-01 08:44:59Z

1

Using prepared statements with bound parameters is enough. You don't need to use mysql_real_escape_string (and you probably could not even if you wanted -- you 'd need a MySql connection resource in hand to do it).

answered Aug 1, 2011 at 8:44

Jon

439k85 gold badges756 silver badges820 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Arkh · Accepted Answer · 2011-08-01 09:36:33Z

0

I'd do something like that to exclude a lot of useless characters from your table name:

$tableName = '`' . preg_replace('`[^-a-zA-Z0-9_]`', $this->getM_oUser()->getM_sTableName()).'`';
$stmt = $aPDO->prepare("INSERT INTO ".$tableName." (email, hash_pw, hash_key) VALUES (:email, :hash_pw, :hash_key)");

answered Aug 1, 2011 at 9:36

Arkh

8,44043 silver badges47 bronze badges

Collectives™ on Stack Overflow

How to sanitize data in php in order to avoid SQL injection?

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related