I was wondering if I could please get some justification if the PHP code I wrote using Mysqli prepared statements would be able to withstand SQL injection attacks.
I have one field that gets a value from a form. Code works 100% fine, just want to make sure it is secure against SQL injection.
$steaminput = filter_input(INPUT_POST, 'steamid_user', FILTER_SANITIZE_STRING);
$conn = mysqli_connect(host, user, pass, table);
$sql = "SELECT username, activated, expiration_date FROM donors WHERE steam_id=?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "s", $steaminput);
mysqli_stmt_execute($stmt);
mysqli_stmt_bind_result($stmt, $username_res, $activated_res, $expiration_res);
while(mysqli_stmt_fetch($stmt)){
$data = array('username'=>$username_res, 'activated'=>$activated_res, 'expiration_date'=>$expiration_res);
}
mysqli_stmt_close($stmt);
mysqli_close($conn);
//I use array information from retreival here
