How to use/write mysql_real_escape_string in PDO?

Question

In my code Im trying to translate mysql_real_escape_string into a PDO statement. Does somebody have a tip on how to write mysql_real_escape_string in PDO? Im using mysql_real_escape_string in two lines: $userName = mysql_real_escape_string($_POST['username']); $password = sha1(mysql_real_escape_string($_POST['password'])); ``` user: " . $userName; echo "
pw: " . $password; $query = "select * from tbladmin where admin_usr_name='$userName' and admin_pwd='$password'"; $res = mysql_query($query); // $rows = $res->fetch(PDO::FETCH_ASSOC); $rows = mysql_fetch_assoc($res); echo "
numrows" . mysql_num_rows($res) . "
"; // $find = $query->prepare("select * from tbladmin where admin_usr_name='$userName' and admin_pwd='$password'"); // $find->execute(); // if ($find->fetchColumn() > 0) // {…

Accepted Answer

The point is by using prepared statements with parameterised queries and bound values you don't need things such as `mysql_real_escape_string`.

Check out the PDO documentation on how to use bound values and parameterised queries/prepared statements.

The point is that you would write an SQL query as such:

```
$query = $pdo->prepare("SELECT * FROM users WHERE username = ? and password = ?");
```

You would then pass in the bound values in place of the ? symbols, thus the query is only ever run literally as so:

```
$query->bindParam(1, $username);
$query->bindParam(2, $password);
```

Any sort of SQL injection attempt such as `1'; DROP users --` inside the variables above would no longer work as it would be called literally.

How to use/write mysql_real_escape_string in PDO?

Solution

Problem

Related problems