PDO SQL Injection Doubt

0

I'm venturing a bit with PDO, still in the beginning, and I have a question regarding a query with SQL Injection, it follows:

$insert = "INSERT INTO tabela (campo1, campo2, campo3) VALUES (:valor1, 
:valor2, :valor3)";

$db = new db();
$db = $db->connect();
$stat1 = $db->prepare($insert);
$stat1->execute([
  ":campo1" => $valor1,
  ":campo2" => $valor2,
  ":campo3" => $valor3
});

Would that be correct? It's running smoothly, but is it safe?

Thank you guys!

    
asked by anonymous 19.05.2018 / 23:26

1 answer

0

You are sure, as long as you do not concatenate parameters with your query ($ insert in case) everything is safe

    
19.05.2018 / 23:35