Geek Answers Handbook

PDO security and html special characters?

Does PDO use html special characters by default? Or is it even better to turn it on or off using php, I can not find the documentation on whether this is possible or not?

Just to clarify, if you use prepared statements, I almost do not give in to injection?

+4
source share
1 answer

Does PDO use html special characters by default?

No; PDO is a database library and therefore does not care about HTML. If you display data from your database on a web page, you still need to output HTML code to display.

Just to clarify, if you use prepared statements, I almost do not give in to injection?

Until you interpolate the values ​​directly into your queries, then yes - you are not vulnerable to SQL injection.

+3
source

More articles:


All Articles