PHP PDO securety

Asked Feb 16 '17 at 14:09

Active Feb 16 '17 at 14:13

Viewed 30 times

I had created an PHP-Object for my Database, and now i have a question is it protected from SQL-Injections??? Here my method to load Data form Database

public function loadData($query, $params = []) {
$stmt = $this->db->prepare($query);
$stmt->execute($params);
return $stmt->fetchAll();
}

My Query

$user_id = trim($_GET['user']);
$article_id = trim($_GET['article']);

$data = loadData("SELECT * FROM articles WHERE user = ? AND article = ?", [$user_id, $article_id]);

or this solution.

$myData = [$user_id, $article_id];

$data = loadData("SELECT * FROM articles WHERE user = ? AND article = ?", $myData);

edited Feb 16 '17 at 14:13

Your Common Sense

156,878
40
214
345

asked Feb 16 '17 at 14:09

user6834389

Both options come out exactly the same, no difference. – arkascha Feb 16 '17 at 14:14
A hint: make your function return $stmt. It will keep the current functionality but also will make this function a lot more useful. – Your Common Sense Feb 16 '17 at 14:16
They are exactly the same options, but you shouldn't access $_GET directly. – Vini Feb 16 '17 at 14:16
My question was, is it secure enough to prevent SQL-Injection. Thank you – user6834389 Feb 16 '17 at 14:19
What is not clear from the linked answer? thanks. – Your Common Sense Feb 16 '17 at 14:21

PHP PDO securety

0 Answers0