note 81956 added to ref.pdo

Please note that the use of _GET['name'] inside the prepared statement in example #11 is exactly the kind of Bad Stuff(tm) you shouldn't do, whichever database abstraction you use. Even if PDO internally escapes the input, this might well slip through, should you choose to migrate to a different abstraction. Imagine a form where I write my name: [Robert] [<enter>] My name will be looked up well enough, but imagine I wrote: [Robert '; DROP TABLE Students; --] [<enter>] instead; Now your query might end up being: SELECT * FROM REGISTRY where name LIKE '%Robert'; DROP TABLE REGISTRY; --%' - which will drop your REGISTRY table on the floor. *Never* allow user input into your sql statements unprocessed. In the example above, you might instead simply $name = $dbh->quote($_GET['name']); $stmt = $dbh->prepare("SELECT * FROM REGISTRY where name LIKE ?"); $stmt->execute(array("%$name%")); ---- Server IP: 195.184.96.15 Probable Submitter: 80.251.196.194 ---- Manual Page -- http://www.php.net/manual/en/ref.pdo.php Edit -- https://master.php.net/note/edit/81956 Del: integrated -- https://master.php.net/note/delete/81956/integrated Del: useless -- https://master.php.net/note/delete/81956/useless Del: bad code -- https://master.php.net/note/delete/81956/bad+code Del: spam -- https://master.php.net/note/delete/81956/spam Del: non-english -- https://master.php.net/note/delete/81956/non-english Del: in docs -- https://master.php.net/note/delete/81956/in+docs Del: other reasons-- https://master.php.net/note/delete/81956 Reject -- https://master.php.net/note/reject/81956 Search -- https://master.php.net/manage/user-notes.php