这足够安全吗？

Question

I'm new with PDO, and I just wanted to know if this code:

$string = $_POST['string'];
$matches = $SQL->prepare("SELECT * FROM `users` WHERE `name` LIKE ?");
$matches->execute(array('%'.$string.'%'));

foreach($matches->fetchAll() as $match) {
    echo $match["name"]."<br/>";
}

Is secure enough? I just wan't to be sure and prevent from hacking. This code will withdraw all users from the database with name like in the $string variable.

Feel free to post your solutions also!

Answer 1

在执行查询之前，PDO将自动转义为其提供的任何输入，因此就SQL注入攻击而言，它是安全的。