php - Is this code safe against mysql injections? -
$stmt_update = $db->prepare("update 2_1_journal set recordday = ?, number = ? "); $stmt->execute(array($amount1, $date_day1)); is safe against mysql injections? if safe, understand because of "= ?". question how "= ?" works/helps question because here http://php.net/manual/en/pdo.prepare.php written prepared statements project sql injection if use bindparam or bindvalue option. for example if have table called users 2 fields, username , email , updates username might run update `users` set `user`='$var' where $var user submitted text. now if did <?php $a=new pdo("mysql:host=localhost;dbname=database;","root",""); $b=$a->prepare("update `users` set user='$var'"); $b->execute(); ?> and user had entered user', email='test test injection occur , email updated test user being updated user. in code (above) there no bindparams , no bi...