title: PDO password_verify, do I need to sanitize?
body: <p>I have a <code>login.php</code> file using pdo for my website. For all my other queries up to this point based on user input, I've been using prepared statements, to protect against sql injection. However, for the login section, I'm comparing the inputted password against the hashed value in my database using <code>password_verify()</code>. I can't really use a prepared statement for this as my code looks like this:</p>
  
  <pre><code>if($res-&gt;fetchColumn() == 1){
          $stmt2 = $conn-&gt;prepare("SELECT `password` FROM members WHERE :email = `email`");
          $stmt2-&gt;bindParam(':email', $email);
          $res2 = $stmt2-&gt;execute();
          $passhash = $res2-&gt;fetchColumn();
          $password_verify($_POST[password], $passhash);
          //^^ do i need to sanitize that?
  
  
      }else{
          //login failed
      }
  </code></pre>
  
  <p>This seems like it will be a simple answer, but I just want to make sure I'm doing it right.</p>