在PHP-MySQL中绑定变量

Question

I am using below code to execute MySQL query in PHP .

$cus_id = '1';
$query = new QUERY();
$clause = "SELECT * FROM customers WHERE cus_id=:cus_id AND status='ACTIVE'";
$params = array('cus_id'=>$cus_id);
$result = $query->run($clause, $params)->fetchAll();

Now the question is: is it secure enough. Or do I need to bind the static String as well? Something like:

$clause = "SELECT * FROM customers WHERE cus_id=:cus_id AND status=:status";
$params = array('cus_id'=>$cus_id, 'status'=>'ACTIVE');

Answer 1

It's secure because ACTIVE isn't user input. So you don't need to bind it.

Answer 2

It's fine the way you have it. The value for status isn't being dynamically assembled and doesn't create any vulnerabilities.