prepared statements - sql injection

Is it safe?

[bethesda]

Hello.
I try to figure it out is my statement are secure enough:

<?php
$db = new mysqli('#*$!', '#*$!', '#*$!', '#*$!');
$stmt = $db->stmt_init();
if($stmt->prepare("SELECT `col1`, `col2` FROM `tab1` WHERE `something` = ?")) {

$stmt->bind_param('i', $parametr);
$parametr = something;
 
$stmt->execute();
$stmt->bind_result($first, $second);
while($stmt->fetch()) {
echo "$first_row - $second_row"; 
}
 
$stmt->close();
}
?>

Thanks ..

[rocknbil]

You don't really show **how** input data gets to your statements, and that's where security issues lie.

[bethesda]

Does it protect me against sql injection?

[topr8]

well in this case the parameter must be an integer so it should be safe.

however it is good practice to check that the data is an integer (or whatever) before using the prepared statement.

also it is good practice, to really lock down your database permissions (just in case) each table and even each column should only have the permissions required by the username ... eg if the user doesn't need to update a table, don't give that user update permissions, ditto: delete, insert etc etc

[bethesda]

Thanks.
Can i use mysql instead of mysqli in prepared statements ?

$db = new mysql('#*$!', '#*$!', '#*$!', '#*$!');

doesn't work :-/

[penders]

The (old/original) PHP MySQL extension does not support an object orientated interface (procedural only) or prepared statements. So, you will need to use the mysqli extension (or PDO [am.php.net]) for this.