PDO without mysql_real_escape_string and bindValue

Question

I'm relatively new to PDO and i have written the following block of code:

$id = $_GET['id'];

$db = new PDO('mysql:host=localhost;dbname=testdb;charset=utf8', 'username', 'password');

foreach($db->query("SELECT id,name FROM names where id = '$id' ") as $row) {
    echo "<p>", ($row['name']), "<br>";
}

My uncertainties are:

is it safe to OMIT mysql_real_escape_string in the first line since i'm using PDO
is it safe to run the query as above without using bind values.

Thanks

mysql_real_escape_string has no connection to PDO; don't use. it. Re 2. Nope, it's not safe — Pekka
– Pekka, Commented Jul 23, 2013 at 15:16
@JasonMcCreary because Pekka has too much reps.... leaving something for newbies like us lol. — itachi
– itachi, Commented Jul 23, 2013 at 15:29

gen_Eric · Accepted Answer · 2013-07-23 15:23:23Z

4

No, this is not safe. PDO doesn't magically escape your queries for you. Your code, as shown, is wide open to SQL injection.

If you are using variables in your query, don't use ->query. Do not try to escape them yourself. You should be using prepared statements. That's the way to be safe.

$stmt = $db->prepare('SELECT id,name FROM names where id = ?');
if($stmt->execute(array($id))){
    while($row = $stmt->fetch(PDO::FETCH_ASSOC)){
        echo "<p>", ($row['name']), "<br>";
    }
}

So, yes, you need to use bindParam, or execute, as shown.

P.S. mysql_real_escape_string is only for the (deprecated) mysql_ extension. It doesn't work with PDO.

edited Jul 23, 2013 at 15:23

answered Jul 23, 2013 at 15:16

gen_Eric

228k42 gold badges304 silver badges343 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

adeoba Over a year ago

I will mark this as the answer, but do you mind clarifying 2 things: 1. Is there a way to make your code a little simpler 2. Can this method also be used where there are no variables involved? Thanks.

gen_Eric Over a year ago

How much simpler do you want it? What's complicated about it? If there are no variables to bind, then it's perfectly OK to use ->query().

itachi · Accepted Answer · 2013-07-23 15:18:22Z

2

to answer your questions,

it is safe to omit mysql_real_escape_string as long as you use bindings (well.... you can't use mysql_real_escape_string with PDO anyway)
Nope. It is absolutely unsafe. doesn't matter whether you are using PDO or not.

answered Jul 23, 2013 at 15:18

itachi

6,3933 gold badges33 silver badges41 bronze badges

Collectives™ on Stack Overflow

PDO without mysql_real_escape_string and bindValue

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related