Pdo anti-injection: after all, it is better to use quotation marks instead of quotation marks.

Pdo injection prevention question: should we use quotation marks or do not use quotation marks? At last, this post was edited by sky94132003 from 2014-08-2706: 07: 37. The anti-injection php version is & nbsp; 5.4.28 is it safe to use preprocessing for all SQL statements in MYSQL? I heard that some people prefer to use & nbsp; PDO: quote & nbs pdo anti-injection. do you want to use quotation marks or not to use them?

This post was last edited by sky94132003 at 06:07:37

PDO anti-injection
Php version 5.4.28
It uses MYSQL

All SQL statements have been preprocessed.

Is it safe enough?

I heard that some people prefer to use PDO: quote to add single quotation marks to all fields.

Are some old PHP versions required?

Is this required only when preprocessing is not performed?

The following are common code modes:

Is it enough for anti-SQL injection?

Could you tell me what needs to be improved?

$add_title="INSERT INTO `topic_title` (`id`,`title_name`,`typeid`) VALUES (NULL,:title_name,:typeid)";
$stmt = $pdo->prepare($add_title);
$stmt->bindParam(':title_name',$title_name);
$stmt->bindParam(':typeid',$typeid);
$stmt->execute();

------ Solution --------------------
Yes, in terms of the current knowledge scope: Enough
------ Solution --------------------
Enough, prepare has done the put injection processing.
------ Solution --------------------
Security is sufficient.