Jump to content

Sql Injection


Recommended Posts


Boas a todos,

Estou com uma dúvida em mãos relacionada com Sql injection.

Basicamente queria saber se o uso de PDO (prepared statements) será a solução que procuro, contra este tipo de ataques.


Edited by EuricoFerreira
Link to post
Share on other sites

Se me focar neste método, haverá probabilidade de existir alguma hipótese de sql injection?

$stmt = $conn->prepare(
'INSERT INTO posts (title, content) VALUES (:title, :content)'

$title = 'Titulo do post';
$content = 'Conteudo do post';

$stmt->bindValue(':title', $title);
$stmt->bindValue(':content', $content);
Link to post
Share on other sites


Use prepared statements and parameterized queries. These are SQL statements that are sent to and parsed by the database server separately from any parameters. This way it is impossible for an attacker to inject malicious SQL.

Tens também na resposta aceite como assegurar que não há ataques à base de dados.

Edited by yoda
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...

Important Information

By using this site you accept our Terms of Use and Privacy Policy. We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.