I am using the below code to execute a MySQL query in PHP.

$cus_id = '1';
$query = new QUERY();
$clause = "SELECT * FROM customers WHERE cus_id=:cus_id AND status='ACTIVE'";
$params = array('cus_id'=>$cus_id);
$result = $query->run($clause, $params)->fetchAll();

Is it secure enough, or do I need to bind the static variable as well as seen below?

$clause = "SELECT * FROM customers WHERE cus_id=:cus_id AND status=:status";
$params = array('cus_id'=>$cus_id, 'status'=>'ACTIVE');

The static variable 'ACTIVE' can not be messed with from the outside in any way, is therefore safe in the first example.

The only reason I can come up with to still warrant a change to the second snippet is for consistency and future refactors. Suppose you want to change the method where this query appears and you want to give the user the freedom to choose between ACTIVE and ARCHIVED? To prevent yourself from making a very quick change and potentially creating a vulnerability, you should possibly make a habit of escaping every variable.

(Though in the specific case of a status fields where only a specific list of constants is valid I'd definitely also validate that the input is a valid input.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.