0
\$\begingroup\$

I was wondering if I could please get some justification if the PHP code I wrote using Mysqli prepared statements would be able to withstand SQL injection attacks.

I have one field that gets a value from a form. Code works 100% fine, just want to make sure it is secure against SQL injection.

$steaminput = filter_input(INPUT_POST, 'steamid_user', FILTER_SANITIZE_STRING);
$conn = mysqli_connect(host, user, pass, table);
$sql = "SELECT username, activated, expiration_date FROM donors WHERE steam_id=?";

$stmt = mysqli_prepare($conn, $sql);

mysqli_stmt_bind_param($stmt, "s", $steaminput);

mysqli_stmt_execute($stmt);

mysqli_stmt_bind_result($stmt, $username_res, $activated_res, $expiration_res);



  while(mysqli_stmt_fetch($stmt)){
    $data = array('username'=>$username_res, 'activated'=>$activated_res, 'expiration_date'=>$expiration_res);
  }


mysqli_stmt_close($stmt);
mysqli_close($conn);
//I use array information from retreival here
\$\endgroup\$
1
\$\begingroup\$

The final parameter here is misnamed:

$conn = mysqli_connect(host, user, pass, table);

It denotes name of MySQL database (e.g. "test") rather than name of a table (e.g. "test.donors" or "donors.donors").

The _res suffix is superfluous and may be safely elided:

mysqli_stmt_bind_result($stmt, $username_res, $activated_res, $expiration_res);

want to make sure it is secure against SQL injection.

Yes, you are using the API as recommended, in secure fashion.

\$\endgroup\$
  • \$\begingroup\$ I agree with this answer. It's a simple bit of code, not much can go wrong. \$\endgroup\$ – KIKO Software Sep 2 '17 at 23:14
  • \$\begingroup\$ The $con was just an example. Thanks for the response and the reassurance I did things correctly \$\endgroup\$ – Rushy Sep 3 '17 at 3:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.