PDO :: ATTR_EMULATE_PREPARES => false

Question

I am new to php and PDO, so I read this answer to a similar entry →

Doesn't PDO really use prepared statements with mysql? Yes, by default (at least with version I), but the built-in mode can be turned manually. If not, can this be done? Using PDO :: ATTR_EMULATE_PREPARES, the name is pretty self-explanatory. $ dbh-> setAttribute (PDO :: ATTR_EMULATE_PREPARES, false); if you do it This is the most difficult question. Well, I would say yes. If you choose PDO as your db driver, it makes no sense to use it in emulation mode.
- your common sense

Security operators from SQL injection are not prepared, why change if from 'true' → false ?? What is native mode?

Answer 1

I have changed my mind ever since.

First of all, each mode is safe.
This is not a built-in binding that makes a prepared statement safe, but a general principle of a parameterized statement that formats a complete statement and thus creates an invulnerable request.

So, I would rather keep the emulation mode on , since it makes more sense with average Internet usage and allows you to use small amenities, such as more reasonable error messages (with data actually replaced in the request) or several placeholders with the same name.

- - . , , .

Answer 2

, - , sql. , ,

$result = $this->db->select('SELECT * FROM tbl_users WHERE login = :login AND password = :password', $arraiul);

function editusers(){
        $id = $_POST['id'];
        $name = $_POST['name'];
        $login = $_POST['username'];
        $password = $_POST['password'];
        $email = $_POST['email'];
        $power = $_POST['power'];
        if ($password ==''){
            $sqlstm = "UPDATE tbl_users SET name='$name', login='$login', email='$email', power='$power' WHERE id='$id'";
        } else {
            $sqlstm = "UPDATE tbl_users SET name='$name', login='$login', password=MD5('$password'), email='$email', power='$power' WHERE id='$id'";
        }
        $sth = $this->db->prepare($sqlstm);
        $sth->execute();        
    }
enter code here