PDO prepared statement, correctly used?
pdo, php
Solution
Yes, your code is safe. It can be shortened however:
$data = array( $username, $password, $this->generate_salt(), $email );
// If you don't want to do anything with the returned value:
$this->db->prepare("
INSERT INTO `user` (username, password, salt, email, created)
VALUES (?, ?, ?, ?, NOW())
")->execute($data);
Problem
I just to need make sure I've got the PDO prepare statements correctly, will the following code be secured by SQL Injection? ``` $data['username'] = $username; $data['password'] = $password; $data['salt'] = $this->generate_salt(); $data['email'] = $email; $sth = $this->db->prepare("INSERT INTO `user` (username, password, salt, email, created) VALUES (:username, :password, :salt, :email, NOW())"); $sth->execute($data); ```