Creating user accounts while avoid SQL injection attacks

Question

I have a class that creates user accounts and to avoid SQL injection attacks, I am using the following functions to sanitize both the user name and password inputs:

    $admUsername = filter_var($_POST['admUsername'], FILTER_SANITIZE_STRING);
    $admPassword = filter_var($_POST['admPassword'], FILTER_SANITIZE_STRING);

    $s->bindParam(':admUsername', $admUsername, PDO::PARAM_STR);
    $s->bindParam(':admPassword', $admPassword, PDO::PARAM_STR);

But since I am using filter_var(), when a user creates an account or tries to login, all the special characters like (?,/.!() that s/he inputs are removed. For that reason only alphanumeric characters can be used for the passwords, which might not always be good for the user's security. So my question is, if I use bindParam, is it necessary to also use filter_var or will bindParam do the work that filter_var does?

Answer 1

Prepared statements (which you use, as you use bindParam) are the correct way to prevent SQL injection.

It is still recommended - but not necessary - to clean input parameters with filter_var, but just as a second (or in this case first) line of defense.

What if you forget to prepare that variable somewhere? Maybe when you retrieve it from the db and use it in a second query? Or what if you echo it somewhere and forget to use proper encoding?

No program is 100% secure, so if you know that you never want special characters in your usernames, then it's a good idea to filter. If you do want those characters, then don't filter.

all the special characters like (?,/.!() that s/he inputs are removed.

No, they are not. All those characters pass FILTER_SANITIZE_STRING without a problem. It only strips tags and encodes some chars (single and double quotes). The documentation is not very clear on what tags are, but generally it's something like <.*>, although the filter also removes <bar from foo<bar, so you could get problems if you want to allow the < character.