Question

Usually, I use PDO’s prepared statements, type casting to (int), or PDO::quote() to prevent SQL injection. For this application, I need to modify the date using PHP before adding it to the query. Do I need to take extra steps to prevent SQL injection, or am I safe? Thanks

$date = new DateTime($_GET['suspect_user_provided_date']);
$date->add(new DateInterval('P1D'));
$sql='SELECT * FROM table WHERE date<"'.$date->format('Y-m-d').'"';

Answer 1

It doesn’t matter if the DateTime object is safe or not. You should escape the data you are passing to the query and not to rely on the safety of the provided library. If you change the implementation, you will not need to care if the new implementation is safe or not. You should always escape. Otherwise you will try to answer – and to remember – for each function – was it safe for SQL? for HTML? for CSV? for http / mail headers? for… don’t! The line of code that send a query should know nothing about the DateTime implementation and if it’s safe or not