Is this segment of code a vulnerability ?

[oz11]

.. 

Quickl easy question.

	    $stmt = $pdo->prepare("SELECT *, count(*) FROM users WHERE forgotten_code=? LIMIT 1");
		$stmt->execute([$_GET['reset']]); 
		$check = $stmt->fetch();
		if($check['count(*)'] > 0)
		{

...

My thinking was that as its a PDO its not.
 

Edited October 30, 2022 by oz11

[Barand]

It's poor SQL code.

• Any data returned by the "*" in the select will be meaningless.
• Because you are using an aggregation function the LIMIT is redundant - there will only be a single row containing the count.
• It is better to use a column alias for functions

$stmt = $pdo->prepare("SELECT count(*) as total FROM users WHERE forgotten_code=?");
        $stmt->execute([$_GET['reset']]); 
        $check = $stmt->fetch();
        if ($check['total'] > 0)
        {