如何在php中清理数据以避免SQL注入？

Question

I already used the PDO:

        $stmt = $aPDO->prepare("INSERT INTO ".$this->getM_oUser()->getM_sTableName()." (email, hash_pw, hash_key) VALUES (:email, :hash_pw, :hash_key)");                                             
        $stmt->bindValue(':email', $this->getM_oUser()->getM_sEmail());
        $stmt->bindValue(':hash_pw', $this->getM_oUser()->getM_sHash_pw());
        $stmt->bindValue(':hash_key', $this->getM_oUser()->getM_sHash_Key());

        $stmt->execute();  

Should I also use mysql_real_escape_string() to handle the user input string? Thank you.

Answer 1

Using prepared statements with bound parameters is enough. You don't need to use mysql_real_escape_string (and you probably could not even if you wanted -- you 'd need a MySql connection resource in hand to do it).

Answer 2

I'd do something like that to exclude a lot of useless characters from your table name:

$tableName = '`' . preg_replace('`[^-a-zA-Z0-9_]`', $this->getM_oUser()->getM_sTableName()).'`';
$stmt = $aPDO->prepare("INSERT INTO ".$tableName." (email, hash_pw, hash_key) VALUES (:email, :hash_pw, :hash_key)");