Take the 2-minute tour ×

Super long question regarding MySQLi prepared statments in PHP. Here goes.

Is using MySQLi prepared statments completely invunerable to SQl injection? For example see my code below, am I correct in thinking I can use the $_POST variable straight from the user without any injection protection? For the purpose of this question please ignore validating data to make sure it is the correct format for my database (I always do that anyway), I'm more focussing on security here.


$stmt->prepare('INSERT INTO `tablename` (`column`) VALUES (?)');

$stmt->bind_param('s', $_POST['value']);


Also is my code correct? This only the second or third time I have written a prepared statement using the MySQLi class. Although it works, I was wondering if I am doing everything correctly? Could any part of that script be considered bad practice?

Lastly, how would I go about doing multiple prepared statements that use the same database connection? Do I just use the close() method on the $stmt and then initialize another $stmt class?


share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Parameter binding is secure against SQL injections. You don't need to worry about that part. It's concatenating user input with your SQL statement that is not secure.

share|improve this answer
So my example above is secure because it is binding. Whereas something like mysqli_query("INSERT INTO tablename (column) VALUES ($_POST['value']);") would be insecure because it is concatenating? –  GhostInTheSecureShell Jul 18 '12 at 13:36
Yes. Concatenating can also be secure if the input is escaped properly. But prepared statements and parameter binding, as a matter of design, does not require that extra precaution. –  Parahat Melayev Jul 18 '12 at 13:39
Brilliant, thanks :) Any words of advice for my code? Does it look correct and properly constructed? –  GhostInTheSecureShell Jul 18 '12 at 13:45
I don't see any issues in the code. –  Parahat Melayev Jul 18 '12 at 13:54
add comment

Your Answer


