[Solved] plain mysql prepare statement prevent injection attack?

[I assume that you meant $mysqli is mysqli connection.] Although the execution of stmt1 (the last of your three queries) is safe, the multi-query function you wrote is very unsafe. Running something like userQuery(“‘; delete from user; select * from user where username=””); will actually delete all users from your user table. Assuming $username represents … Read more

[Solved] Should pooled JDBC connections using prepared statements be short-lived or long-lived?

Well, then this is back to the original question – how do I share a PreparedStatement between connections if there are many connections? I thought connections create hence own PreparedStatements. If that is your sole question -honestly, that was not clear from your initial question-, then you don’t need to worry about this at all. … Read more

[Solved] Can I improve my PDO method (just started)

catch(PDOException $e) { echo ‘<p class=”error”>Database query error!</p>’; } I would use the opportunity to log which database query error occurred. See example here: http://php.net/manual/en/pdostatement.errorinfo.php Also if you catch an error, you should probably return from the function or the script. if ($STH) { // does this really need an if clause for it self? … Read more