Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters.


but I am confused regarding the following situation, I have to use parameter or parameter doesn't roll in here.


When calling function

function fetch($id, $subid){
    $result=$con->prepare("SELECT * FROM......WHERE id=$id AND subid=$subid")

If we put static value in code, no user input, what about injection here?



Variable come from another query

$id = $row['id']

//second-query where first query variable is used
$result1=$con->prepare("SELECT * FROM......WHERE id=$id")

//Another Example

$result1=$con->prepare("SELECT * FROM......WHERE id=$id")

Here we use variable associated with a direct database.

1 Answer 1



It's a function. Which means it could be called with different parameters and you cannot foretell whether these will be predefined or not.

Besides, I just don't understand why you're asking at all. Is a prepared statement that hard to use to make you seek a shortcut for a deliberately rare use case?

Then ask how to make a prepared statement easier to use. It's not a rocket science and will make your code as simple as

function fetch($id, $subid){
    $sql = "SELECT * FROM...WHERE id=? AND subid=?";
    return $this->con->run($sql, [$id,$subid])->fetch();

so there will be just no reason to avoid a prepared statement.


This is called a "second order SQL injection", and being the very reason to use a prepared statement for any variable, regardless of the source.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.