Parameter escaping

Just to confirm, the docs say this about xPDO’s handling of parameters and values:

Parameter Escaping - No more having to worry about SQL injection; xPDO uses PHP’s PDO to escape all variables passed in to the SQL call to prevent any malicious calls.

Of course we need to take precautions with properly sanitizing data from the outside. But does this statement mean we no longer have to concern ourselves with having to directly escape each value passed as part of a database query? I’m just *making sure*, as well as trying to avoid redundant escaping processes.

Quote from: cyclissmo at Oct 08, 2010, 01:14 PM

Just to confirm, the docs say this about xPDO’s handling of parameters and values:

Parameter Escaping - No more having to worry about SQL injection; xPDO uses PHP’s PDO to escape all variables passed in to the SQL call to prevent any malicious calls.

Of course we need to take precautions with properly sanitizing data from the outside. But does this statement mean we no longer have to concern ourselves with having to directly escape each value passed as part of a database query? I’m just *making sure*, as well as trying to avoid redundant escaping processes.

PDO’s prepared statements, which xPDO uses (unless you bypass them explicitly by writing direct SQL) will handle sanitizing any user provided input; you do not need to worry about it. You can also do your own by using the (x)PDO::quote() method directly to sanitize input on conditions that cannot be described using prepared statements and parameter bindings.