Question

Is the following a valid way to validate some info coming from a post?

function validate($age, $name, $sex) {
    $pdo = new PDO(...);
    $age = (int)$age;
    $name = $pdo -> quote($name);
    $sex = (strtolower($sex) == "m" ? "m" : "f");

    // and then process data with pdo's query method.
}

Do you see any security flaw in this function? If yes, can you help me to fix them?

Answer 1

That’s totally valid and secure as you won’t receive any SQL Injections. Btw, if you will repeat the query, rather than pdo->query go for prepared statements.