title: Is My PDO Prepared Statement Secure If I Bind The Parameters In The Execute Function?
body: <p>I have some form data that I'm writing to a database with PDO prepared statements.</p>
  <p>This form data is santized and validated on the on the way in to the database with <code>filter_var()</code> functions and regular expressions and when any of this data is outputted to the site it escaped with <code>htmlspecialchars()</code>.</p>
  <p>To prevent SQL injections I'm using I'm using the code below. When I first learnt PDO this was what I saw in the tutorial and I personally find it very easy to read/understand.</p>
  <p>I've noticed on the php.net site and in some other code I've saw recently they used bindparams(), whereas in the code below I've always done this inside an array in the <code>execute()</code> method.</p>
  <p>Is my code below secure? Or must I use bindparams in the way that is shown in the second code example?</p>
  <p>Here is some sample code using a firstname input from a webform</p>
  <pre><code>&lt;?php
  
  $firstname = $_POST['firstname'];
  
  $firstname = filter_var($fname, FILTER_SANITIZE_STRING);
  
  if(empty(trim($fname))){
      $error[] = &quot;First Name cannot be blank&quot;;
  }
  
  $sql = &quot;INSERT INTO users (firstname) VALUES (:firstname)&quot;;
  $stmt = $connection-&gt;prepare($sql);
  $stmt-&gt;execute([
      ':firstname' =&gt; $firstname,
  ]);
  </code></pre>
  <p>In the php.net docs it does the above prepared statement using <code>bindParam()</code>, which seems a little verbose if you are updating a number of fields?</p>
  <pre><code>&lt;?php
  $sql = &quot;INSERT INTO users (firstname) VALUES (:firstname)&quot;;
  
  $stmt = $connection-&gt;prepare($sql);
  $stmt-&gt;bindParam(':firstname', $firstname);
  $stmt-&gt;bindParam(':lastname', $lastname);
  
  $stmt-&gt;execute();
  </code></pre>
  <p>If it is more secure then I'll obviously have to do it the second way, but wanted to check if my prepared statements given in the first code block are secure ?</p>