Question

I’m a bit confused when to take the long way around and use prepare and bind, when using PDO in php.

In the code below, should I use prepare instead? If i use this code, will the $name be escaped, or do I need to use mysql_real_escape_string?

$stmt = $db->query("UPDATE matches SET playerStatus = 4  WHERE name='$name' ");

Thanks

Answer 1

I’m a bit confused when to take the long way around and use prepare and bind

That’s the robust, hard to screw up, easy to read, easy to maintain approach. Don’t think of it as “the long way around”.

In the code below, should I use prepare instead?

Yes. Always use something that allows bound arguments.

If i use this code, will the $name be escaped,

The code in the question, as written, will not escape $query. You are just mashing together strings. There is no way for the database code to know what is SQL you have written and what is unsafe external data.

or do I need to use mysql_real_escape_string?

You need to use something that allows bound arguments.