sql-injection-prevention

sql-injection-safe.php

<?php

require 'pdo.php';

//1. Create an instance of connection
$pdo_obj = new Connection();


//2. Connect to the server + db
try
{
	$connection = $pdo_obj->connect();
}catch(Exception $e){
	echo $e->getMessage();
}

//3. Imagine that you are getting input from user
//We will use this string for injecting vulnerable code
$id = "anna' OR '1'='1";



//4. Prepare sql query 
$sql = "SELECT * FROM USER WHERE id = ?";

echo $sql;


//5. Prepare, execute, and display
	$stmt = $connection->prepare($sql);
	$stmt->execute(array($id));
	//$stmt->bindParam(':ids',$id,PDO::PARAM_INT);
	//$stmt->execute();
	$arrValues = $stmt->fetchAll(PDO::FETCH_ASSOC);

	//If the db returns some result
	if($arrValues)
	{
		echo "<table border='1px'>\n";
	
			echo "<tr>\n";
			foreach ($arrValues[0] as $key => $useless){
			    echo "<td>$key</td>";
			}
			echo "</tr>\n";

			//display data
			foreach($arrValues as $rows)
			{
				echo "<tr>";
					foreach($rows as $key=>$value)
					{
						echo "<td>".$value."</td>";
					}
				echo "</tr>";
			}

		echo "</table>";
	}
	else
	{
		echo "<br/>No results were found!";
	}

	

?>