Security in PDO in PHP

Asked Jan 26 '18 at 13:59

Active Jan 26 '18 at 14:09

Viewed 64 times

I have this code in PHP that uses PDO to search for a publication through a slug:

<?php

$slug = "my-slug";

$conexion = new PDO("mysql:host=localhost;dbname=testdb;charset=utf8","root","");
$conexion->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$conexion->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);

// Method 1

$sql = $conexion->prepare("SELECT id,titulo,contenido FROM publicaciones WHERE slug = :slug");
$sql->bindParam(":slug",$slug,PDO::PARAM_STR);

// Method 2

//$slug_full = "%". $slug . "%";

//$sql = $conexion->prepare("SELECT id,titulo,contenido FROM publicaciones WHERE slug LIKE :slug");
//$sql->bindParam(":slug",$slug_full,PDO::PARAM_STR);

$sql->execute();

$resultado = $sql->fetch();

echo $resultado["id"];

?>

I have two questions :

Is the code safe? How do I prevent the attacker from making multiple queries in the code?

edited Jan 26 '18 at 14:09

asked Jan 26 '18 at 13:59

Chris

Looks safe to me at a glance. – Jonnix Jan 26 '18 at 14:01
You're only calling `execute` once - is there any reason you suspect an attacker could execute more than one? This code looks fine to me. – iainn Jan 26 '18 at 14:01
Ok, thanks for comment, update the post with a second query, method 2 is also safe? – Chris Jan 26 '18 at 14:10
Correct use of prepared statement. Looks fine to me. – Ibrahim Hafiji Jan 26 '18 at 14:12
[This](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1) pretty famous question should give you the info you need. – William Perron Jan 26 '18 at 15:18
Ok, thanks for the help. – Chris Jan 28 '18 at 13:58

Security in PDO in PHP

0 Answers0