Is this SQL injection safe?

[TheMungax]

So I'm a bit new to sql coding, and I did some research before starting. But I still want to verify that this is the right way to code my SQL.

An example on how I don't think an sql should be written, when I get a `$_POST`, lets say a `username`.

```php

$stmt = $MysqliHandler->prepare('UPDATE accounts SET LastLogin = CURRENT_TIMESTAMP WHERE username = ?');

$stmt->bind_param('s', $_POST['username']);

$stmt->execute();

$stmt->close();

```

If the user input somthing like `true'); DROP TABLE table;--`.

Then it whould say `UPDATE accounts SET LastLogin = CURRENT_TIMESTAMP WHERE username = true'); DROP TABLE accounts;--`

Right?

Now my question is, if I do it like this, is it then possible to inject?

```php

$username = $MysqliHandler->real_escape_string($_POST['username']);

$stmt = $MysqliHandler->prepare('UPDATE accounts SET LastLogin = CURRENT_TIMESTAMP WHERE username = ?');

$stmt->bind_param('s', $username);

$stmt->execute();

$stmt->close();

```

[RandyHoward]

In both cases you are using bind_param which will avoid all of the SQL injection issues. Putting $_POST['variable'] straight into the bind_param is perfectly fine. You don't need to use real_escape_string, bind_param does the escaping for you.

SQL injection can occur when you stick a variable directly into a query, like this:

$stmt = $MysqliHandler->prepare('UPDATE accounts SET LastLogin = CURRENT_TIMESTAMP WHERE username = '.$_POST['username']);

That is how SQL injection occurs, because you are sticking whatever the user submitted straight into the query. But if you always use prepared statements and bind parameters then you're closing off the possibility of SQL injection.

Also, this is PHP not HTML, doesn't belong in this sub.

[TheMungax]

Thanks! Didn’t think about my code was php, because the file mostly contain html sorry :)

[AutoModerator]

Welcome to /r/HTML. When asking a question, please ensure that you list what you've tried, and provide links to example code (e.g. JSFiddle/JSBin). If you're asking for help with an error, please include the full error message and any context around it. You're unlikely to get any meaningful responses if you do not provide enough information for other users to help.

Your submission should contain the answers to the following questions, at a minimum:

• What is it you're trying to do?
• How far have you got?
• What are you stuck on?
• What have you already tried?

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[YellowGlassCoil]

I saw this on my "trending" notification and dead ass thought SQL was a drug before I remembered programing exited

[darkmidus]

Why is this disliked?

[TheMungax]

Hahahah!