Do I need to avoid data to protect against SQL injection when using bind_param () in MySQLi?

Question

As the title says, do I need to avoid user input when using bind_param () or is this done internally?

Thank.

Answer 1

No, you do not need to avoid data to protect against SQL injection when binding parameters.

This does not exempt you from data verification.

When binding parameters, shielding is not performed (internally or otherwise). The SQL statement is prepared using parameter placeholders, and the values ​​for them are passed at run time.

The database knows which parameters and processes them accordingly, in contrast to the interpolation of SQL values.

Answer 2

.

http://mysql.lamphost.net/tech-resources/articles/4.1/prepared-statements.html

", , , . , , , . . MySQL , , .