Do PHP PDO prepared statements need to be escaped?

by

PDO does not escape the variables. The variables and the SQL command are transferred independently over the MySQL connection. And the SQL tokenizer (parser) never looks at the values. Values are just copied verbatim into the database storage without the possibility of ever causing any harm. That’s why there is no need to marshall the data with prepared statements.

Note that this is mostly a speed advantage. With mysql_real_escape_string() you first marshall your variables in PHP, then send an inefficient SQL command to the server, which has to costly segregate the actual SQL command from the values again. That’s why it’s often said that the security advantage is only implicit, not the primary reason for using PDO.

If you concat the SQL command and don’t actually use prepared statments (not good!), then yes, there still is an escape function for PDO: $pdo->quote($string)

More Related Contents:

  1. Can I mix MySQL APIs in PHP?
  2. Can PHP PDO Statements accept the table or column name as parameter?
  3. Can I bind an array to an IN() condition in a PDO query?
  4. How to apply bindValue method in LIMIT clause?
  5. PDOException “could not find driver”
  6. Row count with PDO
  7. PDO get the last ID inserted
  8. How do I use password hashing with PDO to make my code more secure? [closed]
  9. How to view query error in PDO PHP
  10. Insert/update helper function using PDO
  11. PHP PDO – Bind table name? [duplicate]
  12. How to debug PDO database queries?
  13. PDO’s query vs execute
  14. Resetting array pointer in PDO results
  15. PDO multiple queries
  16. How to bind parameters to a raw DB query in Laravel that’s used on a model?
  17. Parametrized PDO query and `LIMIT` clause – not working [duplicate]
  18. Using htmlspecialchars function with PDO prepare and execute
  19. PDO::PARAM for type decimal?
  20. Update query with PDO and MySQL
  21. Undefined class constant ‘MYSQL_ATTR_INIT_COMMAND’ with pdo
  22. Is “SET CHARACTER SET utf8” necessary?
  23. Retrieve (or simulate) full query from PDO prepared statement
  24. PDO returning incorrect, but duplicate, data. Key’s not in database.
  25. PDO: MySQL server has gone away
  26. Checking for an empty result (PHP, PDO, and MySQL) [duplicate]
  27. PDOStatement to JSON [closed]
  28. How can I pass an array of PDO parameters yet still specify their types?
  29. PHP PDO how to run a multiple query request?
  30. Difference between PDO->query() and PDO->exec()

Leave a Comment