Prepared statements are not optional
Escaping by hand fails the first time someone pastes a quote in a name field. PDO with bound parameters does not care about the quote. Use named placeholders if the query is long; use ? if it is short. Do not mix both in one statement.
Related in PDO: Transactions around two writes
Comments · oldest first
Alex Morgan
We still have one report builder that concatenates dates. Ticket opened.
Lea Holm
Does MySQLi get the same lecture? Yes.