Search the Community
Showing results for tags 'pdo mysql injection'.
Found 1 result
-
is this select query code safe from injection? try { $stmt = $db->prepare("SELECT * FROM posts WHERE key=$key"); $stmt->execute(); $row = $stmt->fetch(); } notice there is no bind. $stmt->bindParam(':key', $key); the reason i am asking is that i have many $key variable in the query and i do not know how to use bind in a query such as this... SELECT count(*) FROM posts WHERE MATCH (file) AGAINST ('$key' IN BOOLEAN MODE) OR MATCH (user) AGAINST ('$key' IN BOOLEAN MODE) the $key is not an array and the $key does not change it's value.
