PHP PDO Sanitize variables

Question

Im working with PDO for the first time and im wondering if the below looks safe, I've tried to read up on alternatives to mysql_real_escape and it seems like the 'prepare' method is sufficient enough security wise, can anyone clarify this for me? Still appears vulnerable...

$UID = $_GET['id'];

$sth = $conn->prepare("SELECT * FROM directory WHERE user_active != '' AND ID = :uid");
$sth->execute(array(':uid' => $UID));

See stackoverflow.com/questions/3143614/…

noetix
– noetix

2012-10-22 22:40:49 +00:00
Commented Oct 22, 2012 at 22:40 — noetix
– noetix, Commented Oct 22, 2012 at 22:40

SomeKittens · Accepted Answer · 2012-10-22 22:41:26Z

2

The prepare method is not only sufficient, it's preferred over mysql_real_escape().

Your code works, as $UID will be transmitted with a different protocol than the rest of the SQL statement. Since the database treats it differently, there's no need to escape.

answered Oct 22, 2012 at 22:41

SomeKittens

39.6k19 gold badges117 silver badges145 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP PDO Sanitize variables

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related