KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
Started using PDO prepared statements not too long ago, and, as i understand, it does all the escaping/security for you. for example, assuming $_POST['title'] is a form field. $title = $_POST['title']; $query = "insert into blog(userID, title) values (?, ?)" $st = $sql->prepare($query); $st->bindParam(1, $_SESSION['user']['userID'], PDO::PARAM_INT); $st->bindParam(2, $title); $st->execute(); Is this really safe? Do i have to do anything else? what else do i have to take into consideration? Thanks.
Tags (comma-separated)
Save Edits
Cancel