# Creating user accounts while avoid SQL injection attacks

I have a class that creates user accounts and to avoid SQL injection attacks, I am using the following functions to sanitize both the user name and password inputs:

$admUsername = filter_var($_POST['admUsername'], FILTER_SANITIZE_STRING);
$admPassword = filter_var($_POST['admPassword'], FILTER_SANITIZE_STRING);

$s->bindParam(':admUsername',$admUsername, PDO::PARAM_STR);
$s->bindParam(':admPassword',$admPassword, PDO::PARAM_STR);

But since I am using filter_var(), when a user creates an account or tries to login, all the special characters like (?,/.!() that s/he inputs are removed. For that reason only alphanumeric characters can be used for the passwords, which might not always be good for the user's security. So my question is, if I use bindParam, is it necessary to also use filter_var or will bindParam do the work that filter_var does?

• I have no experience in php but it doesn't seem as overkill to do it, the more protection the better. Unless of course both functions do the same or one of them is very expensive. – Machinarius Jun 25 '15 at 11:58
• It's overkill - bindParam sanitises input for the database anyway. Technically you'd be fine with $s->bindParam(':admUsername',$_POST['admUsername'], PDO::PARAM_STR); ... I'm not saying don't use filter_var, just not for this. See : stackoverflow.com/questions/60174/… – CD001 Jun 25 '15 at 15:35