What is the safest way to use PDO (in & outgoing data) in PHP 5.3

Question

So recently I heard PDO actually isn't safe unless you know exactly what you're doing, or in my case, copy/pasting. Not only that, I didn't know you can't trust your own database either from an attack.. So well, it doesn't feel too right to ask what I'm asking, but I need to make sure I'm safe before it's too late. Not only that, I'm making a game website where users can save their games and when you lose save game data, a lot of us know that it really really sucks. Here is what my PDO connection currently looks like:

$DataB = new PDO( 'mysql:dbname = dbname; host = host.host.host; charset = utf8', 'username', 'password' );
$DataB -> setAttribute( PDO::ATTR_EMULATE_PREPARES, false );
$DataB -> setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );

Honestly, all I know is that it's PDO, and works. Is this pretty much safe to use if I don't change it? Also, what about when I'm inserting data? Well, like this:

$a = $DataB -> prepare( "INSERT INTO `names` (`first`,`last`) VALUES (?,?)" );
$a -> execute( array( $FirstName, $LastName ) );

Now to be honest I'm not too sure if I wrote that correctly, but thats only because I have it in a personal function I made and it would take awhile before I can decode it (the same with the following below too). Now for updating, I've been using this:

$DataB -> prepare( "UPDATE `names` SET :fn WHERE id = :a" ) -> execute( array( ':a' => $IDnumber, ':fn' => $NewFname ) );

which is kind of the same, but it works on one line. I'm not sure if it matters, but I'm not a genius. But I always prefer shorter codes when possible. Now my select one:

$a = $DataB -> prepare( "SELECT * FROM `names` WHERE `password` = :pw AND `email` = :e " );
$a -> execute( array( ':pw' => $_COOKIE['password'], ':e' => $_COOKIE['email'] ) );
while ( $b = $a -> fetch( PDO::FETCH_ASSOC ) ) { $Fname = $b['first'] }
echo $Fname;//<-filtered html in real life

Which makes me wonder if there's any filters I'm missing for the PDO's I have, since I heard I can't trust my own database either. Now, that's pretty much my database user stuff with nothing extra missing (well, nothing important missing). And yes I have read this on this website which sort of says you can't prevent a certain attack before PHP 5.3.6, but my website only has PHP 5.3.0. Or, that's what a live person I just asked said. But still, I'm not certain if how I use my database is even the proper way to use it. For when I insert, update, and select/other user made data when who knows what it looks like.

So long story short, I need to make sure this works in PHP 5.3.0. And doesn't mess up anything important with random user made data.

Answer 1

PDO actually isn't safe unless you know exactly what you're doing,

That's right. Not only for PDO, though.

when you lose save game data, a lot of us know that it really really sucks.

backup it.

Here is what my PDO connection currently looks like:

Here is how it should be looking like

Is this pretty much safe to use if I don't change it?

yes. in terms of safety - yes. You can keep that ATTR_EMULATE thing though. It doesn't matter too much either way.

Also, what about when I'm inserting data?

As long as you can add your data in the query via placeholder, it is perfectly safe.
Troubles starts from where you can't use a placeholder. For a field name for example. In the above link you can find a solution.

$DataB -> prepare( "UPDATE names SET :fn WHERE id = :a" )

This query contains an SQL syntax error.

I always prefer shorter codes when possible.

You have it actually long. "Short" doesn't mean "readable". Readable doesn't mean "stuff as many operators in one line as you can".
You made your code hard to read.

To make it readable, write vertically, not horizontally.

To make it real short, create a helper function to be used like this:

$sql   = "SELECT * FROM `names` WHERE `password` = ? AND `email` = ?";
$Fname = $DB->getOne($sql, $_COOKIE['password'], $_COOKIE['email']);

see - it is both short and readable. Isn't it?

while ( $b = $a -> fetch( PDO::FETCH_ASSOC ) ) { $Fname = $b['first'] }

Manual is your friend

$Fname = $a->fetchColumn();

it have to be. Or at least make it without while.

since I heard I can't trust my own database either.

As long as you can add your data in the query via placeholder, no matter of it's source, it is perfectly safe. Means you don't have to trust or don't trust or think of data source or safety at all. Just follow the rules.

And yes I have read this on this website which sort of says you can't prevent a certain attack before PHP 5.3.6

Actually this ATTR_EMULATE thing mentioned above prevents this marginal vulnerability perfectly.

For when I insert, update, and select/other user made data when who knows what it looks like.

Use placeholders where you can. Where you can't - better ask here first.

There are other vulnerabilities to think of - like XSS, CSRF, file injection and many more.