PDO anti-injection a question, after all, to quote or do not quote the good

PDO anti-injection a question, in the end to the quotation marks or do not quote good?
This post was last edited by sky94132003 on 2014-08-27 06:07:37

PDO anti-injection
PHP version is 5.4.28
It's with MySQL.

All SQL statements have been preprocessed

Is it enough to be safe?

Heard that some people save is like to use the Pdo::quote field all add single quotation marks

Is it necessary to have some older PHP versions?

Is it necessary to do this without pre-processing?

Here are some of the common code patterns

Is it enough on the anti-SQL note?

Ask if there is any need to improve the place?

$add _title= "INSERT into ' topic_title ' (' id ', ' title_name ', ' typeid ') VALUES (Null,:title_name,:typeid)";
$stmt = $pdo->prepare ($add _title);
$stmt->bindparam (': Title_name ', $title _name);
$stmt->bindparam (': typeid ', $typeid);
$stmt->execute ();

------Solution--------------------
Yes, as far as the current scope of knowledge is concerned: enough
------Solution--------------------
Enough, prepare has been put into the treatment of injection.
------Solution--------------------
Safety has been enough.

