0

is this all i need to protect myself from sql injections etc?

    $statement = $db->prepare(
"INSERT INTO blogs (blogtitle, blogdesc, coverimage, userID, frontpage, tags) 
VALUES (:buildtitle, :builddesc, :buildcover, :userid, :frontpage, :addtags)"
);

if ($statement->execute(array(
':buildtitle' => $_POST['addbuildtitle'], 
':builddesc' => $_POST['addbuilddesc'], 
':buildcover' => $_POST['addbuildcover'], 
':userid' => $_POST['adduserid'], 
':frontpage' => $frontpage,     
':addtags' => $_POST['addtags'])));

Anything else i should add or any other type of malicious activity i should be aware of?

craig
  • 111
  • 1
  • 3
  • 12
  • it's safe against sql injection, but nothing in this code could prevent someone from fiddling with the values BEFORE they reach the query, e.g. forging `$_POST['adduserid']` so the data is credited to someone else. – Marc B Sep 23 '13 at 18:58
  • 2
    ..against "malicious activity" is pretty vague. No it will not stop your end users to set your house on fire. – PeeHaa Sep 23 '13 at 18:59
  • Such questions belong to [codereview.se]. – hjpotter92 Sep 23 '13 at 19:01
  • so what other measures should i take before releasing the site to the public? – craig Sep 23 '13 at 19:06
  • @craig Flag this question as **other (needs ♦ moderator attention)** and mention that it be moved to [codereview.se] instead. You'll get better suggestions there. [so] deals with non-working codes only. – hjpotter92 Sep 23 '13 at 19:09
  • We can't answer that. You've provided NO details about your security requirements. "security" isn't something you can just sprinkle on your code like you do with salt on food. "security" is something you have to build into the system in the planning phases, before you write line #1 – Marc B Sep 23 '13 at 19:10
  • didnt even know that codereview existed, have moved it there :) – craig Sep 23 '13 at 19:12

0 Answers0