PHP从Web窗体安全地将数据插入MySql

Question

I am learning php and have been following the OOP creating a data class tutorial at phpbridge.org

In the tutorial they take form data from a post and insert it into the database.

Here is the code:

Step 1: The Form

<h2>New Topic</h2>
<form action="add.php" method="POST">
    <label>
        Title: <input type="text" name="title">
    </label>
    <br>
    <label>
        Description:
        <br>
        <textarea name="description" cols="50" rows="20"></textarea>
    </label>
    <br>
    <input type="submit" value="Add Topic">
</form>

Step 2 Php file

<?php
 require 'TopicData.php';

if (isset($_POST) && sizeof($_POST) > 0) {
    $data = new TopicData();
    $data->add($_POST);
}
?>

Step 3

The Function included in TopicData.php

public function add($data)
{
    $query = $this->connection->prepare(
        "INSERT INTO topics (
            title,
            description
        ) VALUES (
            :title,
            :description
        )"
    );

    $data = [
        ':title' => $data['title'],
        ':description' => $data['description']
    ];

    $query->execute($data);
}

My question is in regards to security. Before this data is inserted into a database wouldn't it be best practice to run each field of the form through the filter_input() function? Also should these be run through filter_var() as well?

If this is necessary what exactly would the filter code look like?

Thanks!

Answer 1

The TopicData.php file is using prepared SQL queries. The benefit of using prepared queries is that it removes the possibility of SQL Injection provided that the SQL query is not based on external input. When using prepared queries, the template of the query is sent separately from the data. This has many benefits which are described here: https://www.w3schools.com/php/php_mysql_prepared_statements.asp

It removes the need for sanitizing form data. However the form data may still need to be filtered using the filter_var functions, if validation is required such as maximum string length, maximum and minimum values etc.