Are PDO prepared statements sufficient to prevent SQL injection?
The short answer is NO, PDO prepares will not defend you from all possible SQL-Injection attacks. For certain obscure edge-cases. I’m adapting this answer to talk about PDO… The long answer isn’t so easy. It’s based off an attack demonstrated here. The Attack So, let’s start off by showing the attack… $pdo->query(‘SET NAMES gbk’); $var … Read more