is PDO secure enough?

Question

I am new to php and stuff like that. But i decided to create my very simple insert page with PDO , so is PDO secure enough against SQL Injection attacks?

Here is my code:

<?php
//Database settings 
$host = 'localhost';
$dbname= 'akar';
$user = 'akar';
$pass = 'raparen';

//Setting up the PDO
$dsn = "mysql:host=$host;dbname=$dbname";
$pdo = new PDO($dsn,$user,$pass);


//Check if user entered something, otherwise set the username variable string to nothing.
$username = isset($_POST['username']) ? $_POST['username'] : '';
$password = isset($_POST['password']) ? $_POST['password'] : '';

//Inserting the values to the database using named placeholders 
$query = "INSERT INTO users (username,password)  VALUES(:username,:password)";
$statement = $pdo->prepare($query);
$statement->execute(array(
    ':username'=> $username,
    ':password'=> $password
));

?>

My form:

<input type='text' placeholder='Enter Username here!' name='username' />
<input type='password' placeholder='Enter Password here!' name='password' />
<input type='submit' value='Submit' />

</form>

None of database drivers are secure automatically - they are if you use them properly. — zerkms, Jan 05 '14 at 21:05
Define "secure enough"? It's the best thing going right now as far as a PHP MySQL driver. — random_user_name, Jan 05 '14 at 21:06
@onetrickpony: apart from the fact they are using plain text passwords — zerkms, Jan 05 '14 at 21:07
As long as you provide all values per `->execute(array(`, as above, yes. — mario, Jan 05 '14 at 21:08
Well, OP asked about SQL injection attacks, not about passwords :) — nice ass, Jan 05 '14 at 21:09
Don't worry about the passwords, like I said i am new to php and i like to test what i learned. is this code good for me as a newbie? — Akar, Jan 05 '14 at 21:13
As long as you need to ask, you're looking for review. That is not part of the Q&A we have here on Stackoverflow. Use the code-review site probably. — hakre, Jan 05 '14 at 21:38

score 0 · Answer 1 · edited May 23 '17 at 10:25

0

In your case, that code is fine. It prevents from any first order injection.

There is a really good discussion on this subject in the following question:

Are PDO prepared statements sufficient to prevent SQL injection?

edited May 23 '17 at 10:25

Community

1
1

answered Jan 05 '14 at 21:10

Scopey

6,269
1
22
34

is PDO secure enough?

1 Answers1