note 81956 deleted from ref.pdo by tularis

Note Submitter: Anonymous ---- Please note that the use of _GET['name'] inside the prepared statement in example #11 is exactly the kind of Bad Stuff(tm) you shouldn't do, whichever database abstraction you use. Even if PDO internally escapes the input, this might well slip through, should you choose to migrate to a different abstraction. Imagine a form where I write my name: [Robert] [<enter>] My name will be looked up well enough, but imagine I wrote: [Robert '; DROP TABLE Students; --] [<enter>] instead; Now your query might end up being: SELECT * FROM REGISTRY where name LIKE '%Robert'; DROP TABLE REGISTRY; --%' - which will drop your REGISTRY table on the floor. *Never* allow user input into your sql statements unprocessed. In the example above, you might instead simply $name = $dbh->quote($_GET['name']); $stmt = $dbh->prepare("SELECT * FROM REGISTRY where name LIKE ?"); $stmt->execute(array("%$name%"));