0

I'm writing the following code and want to know if it's still necessary to escape my variables when using bindParam(). 

$usernameCheckQuery = $db->getConnection()->prepare("SELECT username FROM users WHERE username = :username");
$usernameCheckQuery->bindParam(":username", $data['username'], PDO::PARAM_STR);
$usernameCheckQuery->execute();

I've read on some places that it's not necessary and others that say it is. Thanks for any help.

Joe Scotto
  • 10,936
  • 14
  • 66
  • 136

1 Answers1

2

pdo is doing the escaping, so you do not need to. - There may be other types of verification that you should do, but that depends on your code. For a longer answer, see Are PDO prepared statements sufficient to prevent SQL injection?

Community
  • 1
  • 1
MortenSickel
  • 2,118
  • 4
  • 26
  • 44