Tag Info

New answers tagged


I'd wondered as well. Googling a lot I found the answer posted by Benjamin Eberlei himself (Doctrine Project Lead and Contributor): Hello, of course DBAL uses PDO internally and escapes parameters such as in your example. I think the docs are messed up here. The Paragraph relates to the two subparagraphs about quote() and quoteIdentifier() ...


You should use PDO (PHP Data Objects) for preventing SQL Injection attacks. It supports 12 different database systems. Your Generic Class for connecting to MySQL using pdo would look like this: class Db{ public function dbConnect(){ try { $conn = new PDO('mysql:host=host_name/ip;dbname=database_name','user','password'); ...

Top 50 recent answers are included