Programming With Anthony - Prepared Statements
Why Stack Overflow recommends it
Stack Overflow users link it in PHP and MySQL answers and comments as a quick visual explanation of why prepared statements stop SQL injection, usually when steering people off the old mysql_* functions toward PDO or MySQLi.
Recommended by 2 people across 16 different months, 2013 to 2018.
What it is
A 2-minute explainer by Anthony Ferrara (ircmaxell) on how prepared statements work in database access and why they are the preferred way to run SQL. It is part of his short 'Programming With Anthony' video series, from 2012.
What people said
Recommends hakre · 2013-03 · Stack Overflow · on “Is this kind of PDO query protected against SQL injection?”
@Christian: Please take a look at this short video that explains it pretty well: Programming With Anthony - Prepared Statements [this video]
Recommends tereško · 2013-08 · Stack Overflow · on “Passing two variables”
The `mysql_*` functions are **no longer maintained** and shouldn't be used in any new codebase. It is being phased out in favor of newer APIs. Instead you should use **prepared statements** [this video] with either PDO [LINK] or MySQLi [LINK] .
Recommends tereško · 2013-08 · Stack Overflow · on “Cannot redeclare class - php”
Please, do not concatenate SQL queries. Instead learn to use prepared statements [this video] wit PDO. Also, you might benefit from this post [LINK] .
Recommends tereško · 2013-09 · Stack Overflow · on “Update MySQL using HTML Form and PHP”
The `mysql_*` functions are **no longer maintained** and shouldn't be used in any new codebase. It is being phased out in favor of newer APIs. Instead you should use **prepared statements** [this video] with either PDO [LINK] or MySQLi [LINK] .
Recommends tereško · 2013-09 · Stack Overflow · on “how to pass a database connection like to a class”
Please learn to use **prepared statements** [this video] . You current code is vulnerable to SQL injections. Also, you should use the object-oriented API for MySQLi, instead of the procedural one. You also might benefit from applying this [LINK] approach (adjusted for use with MySQLi instead of PDO) for dealing with DB connection.
Recommends tereško · 2013-09 · Stack Overflow · on “php script to save POST to database and send email”
The `mysql_*` functions are **no longer maintained** and shouldn't be used in any new codebase. It is being phased out in favor of newer APIs. Instead you should use **prepared statements** [this video] with either PDO [LINK] or MySQLi [LINK] .
Recommends tereško · 2013-09 · Stack Overflow · on “How to insert values into MySQL using PHP?”
The `mysql_*` functions are **no longer maintained** and shouldn't be used in any new codebase. It is being phased out in favor of newer APIs. Instead you should use **prepared statements** [this video] with either PDO [LINK] or MySQLi [LINK] .
Recommends tereško · 2013-09 · Stack Overflow · on “php auto generate number from my sql db”
The `mysql_*` functions are **no longer maintained** and shouldn't be used in any new codebase. It is being phased out in favor of newer APIs. Instead you should use **prepared statements** [this video] with either PDO [LINK] or MySQLi [LINK] .
Recommends tereško · 2013-09 · Stack Overflow · on “Mysql_fetch_row not populating SESSION array with multiple results”
The `mysql_*` functions are **no longer maintained** and shouldn't be used in any new codebase. It is being phased out in favor of newer APIs. Instead you should use **prepared statements** [this video] with either PDO [LINK] or MySQLi [LINK] .
Recommends tereško · 2013-09 · Stack Overflow · on “ORDER BY specified order”
The `mysql_*` functions are **no longer maintained** and shouldn't be used in any new codebase. It is being phased out in favor of newer APIs. Instead you should use **prepared statements** [this video] with either PDO [LINK] or MySQLi [LINK] .