How do I sanitize input with PDO?

by

If you use PDO you can parametize your queries, removing the need to escape any included variables.

See here for a great introductory tutorial for PDO.

Using PDO you can seperate the SQL and passed parameters using prepared statements, this removes the need to escape strings, as because the two are held seperately then combined at execution, the parameters are automatically handled as stings, from the above source:

   // where $dbh is your PDO connection

   $stmt = $dbh->prepare("SELECT * FROM animals WHERE animal_id = :animal_id AND animal_name = :animal_name");

   /*** bind the paramaters ***/
   $stmt->bindParam(':animal_id', $animal_id, PDO::PARAM_INT);
   $stmt->bindParam(':animal_name', $animal_name, PDO::PARAM_STR, 5);

   /*** execute the prepared statement ***/
   $stmt->execute();

Note: sanitization occurs during variable binding ($stmt->bindParam)

Other resources:

http://net.tutsplus.com/tutorials/php/why-you-should-be-using-phps-pdo-for-database-access/

http://www.phpeveryday.com/articles/PDO-Prepared-Statement-P550.html

http://php.net/manual/en/pdo.prepared-statements.php

More Related Contents:

  1. Can I mix MySQL APIs in PHP?
  2. Can PHP PDO Statements accept the table or column name as parameter?
  3. Can I bind an array to an IN() condition in a PDO query?
  4. How to apply bindValue method in LIMIT clause?
  5. PDOException “could not find driver”
  6. Row count with PDO
  7. PDO get the last ID inserted
  8. How do I use password hashing with PDO to make my code more secure? [closed]
  9. How to view query error in PDO PHP
  10. PDO::__construct(): Server sent charset (255) unknown to the client. Please, report to the developers
  11. Insert/update helper function using PDO
  12. PHP PDO – Bind table name? [duplicate]
  13. Is the leading colon for parameter names passed to PDOStatement::bindParam() optional?
  14. How to debug PDO database queries?
  15. PDO’s query vs execute
  16. Resetting array pointer in PDO results
  17. How to bind parameters to a raw DB query in Laravel that’s used on a model?
  18. Parametrized PDO query and `LIMIT` clause – not working [duplicate]
  19. Using htmlspecialchars function with PDO prepare and execute
  20. Alternative for mysql_num_rows using PDO
  21. ERROR: SQLSTATE[HY000] [2002] No connection could be made because the target machine actively refused it
  22. Unknown database error in PHP but it exists in PHPMyAdmin
  23. How do detect that transaction has already been started?
  24. return one value from database with mysql php pdo
  25. LIKE query using multiple keywords from search field using PDO prepared statement
  26. return multiple response data in one response
  27. PDO lastInsertId() always return 0
  28. Do PHP PDO prepared statements need to be escaped?
  29. How can I pass an array of PDO parameters yet still specify their types?
  30. PDO and MySQL ‘between’

Leave a Comment