Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

Question

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from a form be harmful if you just declare it like:

$entered_email_adress = $_POST['email']; 

before inserting the data into the database? Should you sanitize the submitted data anyway, or is there no reason doing so?

Answer 1

Assuming you're putting the input data into a parameter in the query, it's secure against SQL injections. Anything you insert into a parameter is treated as data only, and cannot become part of the query syntax. String concatenation, however, is not safe.

So this is safe:

$pdo->query('select * from users where user_id = ?', $_POST['id']);

This is not:

$pdo->query('select * from users where user_id = ' . $_POST['id']);

Keep in mind that you'll need to do appropriate output escaping if you want to use the data in a web page later, in order to stop markup injection and cross-site scripting (XSS) attacks.

Answer 2

In my personal experience and from what I've been lead to understand by people more knowledgeable than myself, no sanitation is necessary when using PDO as far as SQL Injection is concerned. In fact, some sanitation solutions have negative impacts (they change the data in a way you might not want it changed.)

While you don't need to sanitize data going into the database while using PDOs, it is still important to sanitize data coming out. For instance, if someone sets their user name to

<script>send_data_to('Russia')</script>

and you just echo the data unsanitized to the world, that could be a problem.