0

For example, I need to use digits for input from a url-based query

So I want to use ctype_digit to make sure that the queries are only numbers, and if I were to bind the parameter just to be safe, which one should I do first, or is it redundant to do both?

I currently have this implemented on a garbage-site (something I lazily put together)

I bind the parameter from the parsed-url then within the results (after the bind part)

I display the entry if the id is a digit, this sounds stupid I know like what the hell am I thinking? I don't know.

I should have ctype_digit it before I bound it, or none at all... I don't get what bind_param does, I looked at the manual...

Binds variables to a prepared statement as parameters

That's all that it does, no filtering?

janicehoplin
  • 397
  • 7
  • 15
  • The validation (i. e., `ctype_digit`) is just for verifying the input is compliant to your data model. And the parameterization of the prepared statement is for ensuring the data is properly passed to the database. These are completely different purposes and are generally performed at different stages within the application (i. e., application logic layer vs. database connection layer). – Gumbo Jun 10 '15 at 15:47

2 Answers2

1

The correct workflow is:

  1. Filter input data ($_GET, $_POST, file...)
  2. Validate input
  3. On success insert/update/delete to db
  4. Otherway usually display error message
venca
  • 1,196
  • 5
  • 18
0

As @venca stated, you want to:
1. Filter input data
2. Validate input
3. Perform your transaction.

Always begin by filtering your input. Optionally, you can compare the result of your filtered input to the original, and if they are different, inform the user that they put in bad data.

To answer your question on Binding a variable to a prepared statement, first understand what a prepared statement is. A prepared statement is a SQL string with the parameters missing, such as:
SELECT Name FROM employees WHERE ID='?';
In this case, if a user were to add an SQL injection, the whole injection is treated as a string to look for rather than a part of the SQL command. For some simple information on this, see How can I prevent SQL-injection in PHP? Also, there are tutorials available that get you started, such as this short one on w3schools on how to use prepared statements in PHP.

Community
  • 1
  • 1
Eddy
  • 76
  • 2