Question

I have a site written in PHP utilizing PDO. I am using the bindParam() function to bind to a sql insert query:

("insert into Table (id, date, data) VALUES (?, ?, ?)")

but I am able to insert a string containing

"<script>window.location="google.com"</script>"

How to prevent this?

Thanks!!!

Answer 1

PDO is not going to stop you do that. You will need to yourself take care of the string:

1. If you do not want <script> tags at all, use strip_tags
2. If you want those tags but don’t want them to execute, then use htmlentities