note 90209 added to pdo.prepare

Note on the SQL injection properties of prepared statements. Prepared statements only project you from SQL injection IF you use the bindParam or bindValue option. For example if you have a table called users with two fields, username and email and someone updates their username you might run UPDATE users SET user='$var' where $var would be the user submitted text. Now if you did <?php $a=new PDO("mysql:host=localhost;dbname=database;","root",""); $b=$a->prepare("UPDATE users SET user='$var'"); $b->execute(); ?> and the user had entered User', email='test for a test the injection would occur and the email would be updated to test as well as the user being updated to User. Using bindParam as follows <?php $var="User', email='test"; $a=new PDO("mysql:host=localhost;dbname=database;","root",""); $b=$a->prepare("UPDATE users SET user=:var"); $b->bindParam(":var",$var); $b->execute(); ?> The sql would be escaped and update the username to User', email='test' ---- Server IP: 69.147.83.197 Probable Submitter: 82.43.225.89 ---- Manual Page -- http://www.php.net/manual/en/pdo.prepare.php Edit -- https://master.php.net/note/edit/90209 Del: integrated -- https://master.php.net/note/delete/90209/integrated Del: useless -- https://master.php.net/note/delete/90209/useless Del: bad code -- https://master.php.net/note/delete/90209/bad+code Del: spam -- https://master.php.net/note/delete/90209/spam Del: non-english -- https://master.php.net/note/delete/90209/non-english Del: in docs -- https://master.php.net/note/delete/90209/in+docs Del: other reasons-- https://master.php.net/note/delete/90209 Reject -- https://master.php.net/note/reject/90209 Search -- https://master.php.net/manage/user-notes.php