So today after few years of not programming in PHP I decided to go back, but to do so I needed to change all MySQL connections. So I want to check if I am using it good.
Earlier I used to write something like this:
$user = clean($_COOKIE["Logged"]);
$GameReg = mysql_fetch_array(mysql_query("SELECT * FROM DB.GameReg WHERE hash='$user'"));
But now it is like this:
$stmt = $dbh->prepare("SELECT * FROM DB.GameReg WHERE hash = :user");
$stmt->bindParam(':user', $user);
$user = $_COOKIE["Logged"];
$stmt->execute();
$GameReg = $stmt->fetch(PDO::FETCH_ASSOC);
So am I using it correctly? I used to do all kinds of filtering before inserting or updating SQL table, but I've read that prepared statements doesn't need that. Is this safe to use?
As I am knew to PDO I am trying to save up some code, so I kinda came up with this:
$stmt = $dbh->prepare("SELECT * FROM DB.GameStats WHERE hash = :user");
$stmt = $dbh->prepare("SELECT * FROM DB.GameReg WHERE hash = :user");
$stmt->bindParam(':user', $user);
$user = $_COOKIE["Logged"];
$stmt->execute();
$GameReg = $stmt->fetch(PDO::FETCH_ASSOC);
$stmt->execute();
$GameStats = $stmt->fetch(PDO::FETCH_ASSOC);
I checked this by trying to call some table members:
echo $GameReg["pass"];
echo "\n";
echo $GameStats["nick"];
It works, but I am not sure if this is the best way to do. Any comments?
