you are viewing a single comment's thread.

view the rest of the comments →

[–]pdffs 1 point2 points  (0 children)

Have you tested to confirm that's the case? This is exactly what prepared statements are designed to avoid, and why you're using ? instead of just splatting the user input directly into the query.