Using PDO without binding
mysql, pdo, php, sanitization
Solution
Yes, it's safe. The only differences between `execute` and `bind*` are:
- `execute` accepts several parameters at once, while you have to `bind*` each one individually
- `bind*` allows you to specify the parameter type, while `execute` binds everything as strings
Passing parameters to `execute` is mostly a convenience shorthand, it's still safe.
Problem
``` $stmt = $conn->prepare('SELECT * FROM users WHERE user_id = :user_id'); $stmt->execute(array(':user_id' => $_GET['user_id'])); $result = $stmt->fetchAll(PDO::FETCH_OBJ); ``` I'm using PDO like that, do I need to sanitise GET parameter? I know if I do `$stmt->bindParam(':user_id', $_GET['user_id'], PDO::PARAM_INT);` than it is not a problem. But is my way safe?