Is this safe to SQL injection?

Question

I made a class that connects to my DB and inserts some values. Is it secure or how can I protect this further from injections? The object declaration will come from variables with POST from a form, after being validated, ofc. Just want to know if this is secure.

<?php
include "db/db_info.php";
/*$DBServer
$DBUser
$DBPass
$DBName*/
class WorkDB {
    private $server;
    private $user;
    private $pass;
    private $name;
    private $conn;

    public function __construct( $server, $user, $pass, $name ) {
        $this->server=$server;
        $this->user=$user;
        $this->pass=$pass;
        $this->name=$name;
    }

    public function tryconn() {
        $this->conn = new mysqli(  $this->server, $this->user, $this->pass, $this->name );

    if ( $this->conn->connect_error ) {
        die( 'Connection Error (' . $this->connconnect_errno . ') '
                . $this->conn->connect_error );
    }


    else echo 'ok';

}

public function query_register( $user, $pass, $email ) {
    $stmt = $this->conn->prepare( "INSERT INTO `users` (`username`, `password`, `email`) VALUES (?, ?,?)" );
    $stmt->bind_param( "sss", $user, $pass, $email );
    $stmt->execute();
    $stmt->close();
}


}//end of class


$a=new WorkDB( $DBServer, $DBUser, $DBPass, $DBName );
$a->tryconn();
$a->query_register( 'a', 'b', 'c' );


?>

ask this @ [**codereview**](http://codereview.stackexchange.com/) ....better suited there :) — NoobEditor, Jun 15 '14 at 16:11
Although this class is unusable in the real life (you aren't going to make another method in this class for the every query in your app, aren't you?), the sql-injection protection part is all right — Your Common Sense, Jun 15 '14 at 16:15
@YourCommonSense your duplicate is wrong. This question belongs on [codereview.se]. — Madara's Ghost, Jun 15 '14 at 16:16
@GeorgeIrimiciuc: at the very least create a core DB class, and put the rest of the functionality in a derived one. but still, cramming all functionality in a single object is very much an anti-pattern. — Karoly Horvath, Jun 15 '14 at 16:24
This has now been [cross-posted to Code Review...](http://codereview.stackexchange.com/questions/54311/injections-and-query) — rolfl, Jun 15 '14 at 16:30
@KarolyHorvath Still, can you tell me how it's done in practice? — George Irimiciuc, Jun 15 '14 at 16:34
It hardly can be "told", but rather should be *learned*, from a year or two in the class. — Your Common Sense, Jun 15 '14 at 16:47

Is this safe to SQL injection?

0 Answers0