PHP bind_param using variables or POST?

Question

When using bind_param with a mysqli prepared statement, I am unsure whether to use $_POST or variables. If the bind_param values come from a form submitted through a website, is it unsafe to put the $_POST values straight into the bind_param ?

$newBlog->bind_param('ss',$_POST['newBlogTitle'],$_POST['newBlogContent']);

or

$newBlogTitle = $_POST['newBlogTitle'];
$newBlogTitle = $_POST['newBlogContent'];
$newBlog->bind_param('ss',$newBlogTitle,$newBlogContent);

Or does it not matter?

Answer 1

s it unsafe to put the $_POST values straight into the bind_param?

String concatenation is key to SQL injection. However, because you are using parameterized queries the data will be automatically escaped and injection risk will be eliminated. It is irrelevant whether or not you assign the $_POST variable to a different variable.

Answer 2

It doesn't matter. The values of the variables are the same, since you're just assigning one to the other.