Is this correct way to prevent SQL injection?

Question

Question to hacker profesionals.

I checked a lot of similar questions and PHP Manual doc along with W3SCHOOLS and they all use different methods that im going crazy with all the possible methods (not sure which one to use?)

(for example PHP Manual uses bind param function:

$stmt->bind_param('sssd', $code, $language, $official, $percent);

But i couldnt get it working so I used this one:

$queryString = "SELECT * FROM mytable WHERE dom='%s' AND key='%s' AND user_id='%i";
$stmt = $wpdb->get_results( $wpdb->prepare($queryString, $dom, $key, $user_id) );

(I assumed %i is integer and %s is string) - this code works but not sure if it prevents sql injection.

Is this correct and enough to prevent SQL injection? (ps variables are normaly created before this, like $dom = "mydom";)

Thanks a lot!

It's best to actually know what you're doing, not just guess, use trial and error, and rely on the say so of others to assure your code's security. This will, one day, end in disaster. — KIKO Software, Jul 08 '18 at 07:39
You may be better off asking the question about why you couldn't get the `bind_param` to work. — Nigel Ren, Jul 08 '18 at 07:44
As for your actual question - this doesn't prevent SQL injection. — Nigel Ren, Jul 08 '18 at 07:45

score 2 · Accepted Answer · answered Jul 08 '18 at 07:47

2

In your example, I see that you are using Wordpress functions so going that route you should consult the documentation for what you are doing, specifically prepare() https://developer.wordpress.org/reference/classes/wpdb/prepare/

Which states "Prepares a SQL query for safe execution..."

So essentially yes you are protecting your query albeit by trusting that Wordpress is doing it correctly internally.

answered Jul 08 '18 at 07:47

D. Simmons

245
1
8

Thanks! yeah i checked with their documentation. sometimes i need to read 10 various sources to understand what was written in the first source ha ha – Coo00000ode BREAKKKKERRRR Jul 08 '18 at 08:11

Is this correct way to prevent SQL injection?

1 Answers1