Do PHP/SQLI Prepared Statements Need Special Character Escaping?

Question

I'm using php/mysqli queries such as this:

$stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)");
$stmt -> bind_param('iiis', $uid, $articleId, $status, $comment);  
$stmt -> execute();

Talking strictly SQL Injection (no buffer overflows from entering 20,000 characters) do I need to do extra checks to guard against special characters such as / -- or ' when running these prepared statements? - Does the prepared statement truly (99.9%) take care of this type of sql injection?

I've been reading some of the other posts on here about prepared statements and i'm not getting a definite answer, is it ok to just check the lengths of the inputs then throw them through statements such as this where I'm directly inserting user data into into a db? - Or does more need to be done?

Answer 1

There is no need to do extra checks if you are using a prepared statement with parameters. This is the industry standard for preventing SQL Injection in PHP.

With the example you provided you would be 100% protected (not 99.9%) from SQL Injection (at least based on what we know today, who knows what the future holds).

That said, there are circumstances where a parameterized prepared statement can still be vulnerable to SQL Injection, but to my knowledge these all involve the use of dynamic SQL which you aren't using here.

You can see OWASP's page on query parameterization here.