I'm using php/mysqli queries such as this:
$stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)");
$stmt -> bind_param('iiis', $uid, $articleId, $status, $comment);
$stmt -> execute();
Talking strictly SQL Injection (no buffer overflows from entering 20,000 characters) do I need to do extra checks to guard against special characters such as /
--
or '
when running these prepared statements? - Does the prepared statement truly (99.9%) take care of this type of sql injection?
I've been reading some of the other posts on here about prepared statements and i'm not getting a definite answer, is it ok to just check the lengths of the inputs then throw them through statements such as this where I'm directly inserting user data into into a db? - Or does more need to be done?