PHP, PDO, is this function secure if not what else i need to cover here

Question

the PDO conneciton is:

  public function __construct(){
    $this->conn = new PDO("mysql:host=localhost;dbname=dms","root","");
    $this->conn->exec("SET CHARACTER SET utf8");
}

now here is the function to get the result of the required rows.

public function getAny() {
            $stmt9 = $this->conn->prepare("SELECT * FROM " . self::$table_name);
            $stmt9->execute();
            return $stmt9 = $stmt9->fetchAll();
            }

after this on view we will fetch out the rows after running the function. this is the view.php

         $doc = $organ->getAny();
         if(count($doc)){
            foreach($doc as $data){
                    echo $data['id'] . "<br />";
                            echo $data['nameARABIC'] . "<br />";
                    }

is this view.php secure and what else should i do for securing more. regards

This question is probably more suited for [CodeReview](http://codereview.stackexchange.com/) — Mark Miller, Jun 10 '14 at 07:52
All of this is already explained, in http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Hristo Valkanov, Jun 10 '14 at 07:53
i can not use htmlspecialchars, because if i do it my text is arabic and it will not show it. — SAR, Jun 10 '14 at 07:53
@abas_rafiq , so you need rephrase your question or create new one. — sectus, Jun 10 '14 at 07:54

Kei · Answer 1 · 2014-06-10T09:24:53.913

What you're doing is pretty safe, though I suggest you to use "SET NAMES UTF8" instead of "set character set". OR better, if you're on php >= 5.3.6 you can use the "charset" parameter INSIDE the DSN. Further information.

Also, to avoid SQL Injections, you should ALWAYS avoid putting user's input inside a string, then using it for SQL. E.g. if self::$table_name is a user input (though it's not) you should be careful and do one of two things:

Escape through PDO::quote()
Use prepared statement

~~In the end:~~

return $stmt9 = $stmt9->fetchAll();

Will return whether or not the assignation was completed (either, true or false, not the content of $stmt9->fetchAll() ).

As pointed out by YourCommonSense, the behaviour depicted in the last part, is not correct.

PHP, PDO, is this function secure if not what else i need to cover here

1 Answers1