3 ms·
So what's the actual way of doing this in PHP?
by Zababa 5y ago
So what's the actual way of doing this in PHP?
- themodelplumber 5y agoThat really depends on whether you are using raw PHP or a CMS, CMF, or application framework. If it's any of the latter you should check with the development team. In many cases there are some great tools already provided for you by the frameworks, or there are helpful conventions that make things more efficient. If it's raw PHP I wouldn't want to compete with a lot of great SO results out there, but you also have to take into account circumstantial matters, like whether the given approach is appropriate to the needed output or input you are dealing with. For this reason I'd recommend arranging for some kind of code review even if you ask online strangers for input.
- mr-ron 5y agoLast I looked, it was to leverage the $mysqli->real_escape_string method.
- hu3 5y agoAll top frameworks support parameter binding. Same for PHP standard library like PDO or mysqli which also provide parameter binding. These eliminate SQL injection. But you have to use them and not just concatenate user input to SQL queries.
- acomjean 5y agoPDO. You write the query and insert the variables in a second step. I’ve been doing php 10+ years and that’s all we’ve been using. Or if your framework has an orm you can use that. There are pdo drivers for most popular databases https://www.php.net/manual/en/book.pdo.php https://www.php.net/manual/en/book.pdo.php Honestly it’s my favorite way of accessing databases (compared with Java Perl and python)
- tored 5y agoUsing prepared statements, with the PDO database driver it would be something like this $stmt = $pdo->prepare('INSERT INTO user (email) VALUES(?)'); $stmt->execute([$email]); For a full example you can look here, includes injection example https://3v4l.org/Fh2Pt https://3v4l.org/Fh2Pt