Do PHP PDO prepared statements need to be escaped?

后端 未结 5 660
Happy的楠姐
Happy的楠姐 2020-11-29 06:25

On the PDO::Prepare page it states,

\"and helps to prevent SQL injection attacks by eliminating the need to manually quote the parameters\"

5条回答
  •  鱼传尺愫
    2020-11-29 07:15

    If you prepare a statement and use bindParam or bindValue to supply variables, you do not need to escape the variables. Note that these functions assume that the variable contains a string, so use the third parameter to bindValue if you want to use booleans or floats.

提交回复
热议问题