note 53625 modified in function.pdo-quote by dbs
| From: | dbs@php.net | Date: | Wed, 19 Oct 2005 19:45:05 +0000 |
| Subject: | note 53625 modified in function.pdo-quote by dbs | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-97247@lists.php.net to get a copy of this message | ||
Note that you should still do your own checking for proper wildcard characters such as % and _.
Doing a select ... where email=:email could be dangerous if the user passes % as their e-mail
address.
--was--
Since the manual is not entirely clear, using ::quote() is really not required if you use the
recommended prepared statements:
<?php
$st = $pdo->prepare( "insert into Foo ( bar ) values( :bar )" );
$st->bindParam( ":bar", $bar, PDO_PARAM_STR );
$st->execute();
?>
is safe without using quote() on $bar. PDO will select the correct quoting method for your SQL
driver.
Note that you should still do your own checking for proper wildcard characters such as % and _.
Doing a select ... where email=:email could be dangerous if the user passes % as their e-mail
address.
http://php.net/manual/en/function.pdo-quote.php