Do prepared statements in PDO really increase security?

Question

I wonder if those prepared statements of PDO really increase security, or if they are just a "cheap" text-replace in the query. The point of prepared statements actually is, that whatever gets inserted as parameter, will not be parsed by the DBMS as part of the instructions itself, so a parameter like

"'; DROP TABLE foobar;"

has no effect and does not break the query. Does anyone know this in detail? I thought to use PDO with prepared statements for preventing sql injection. It turns out that they are hard to use (and don't even work, at least on my local machine), so I want to find this out before wasting much more time with PDO ;-)

Answer 1

Yes, they increase security. PDO or MySQLi also increases speed versus the regular MYSQL methods in PHP because the data is passed in a more compact form.

Answer 2

Creating a prepared statement sends the query-with-wildcards to the server for parsing, and returns a token to call that statement.

A call merely involves sending the data bound to every parameter. This means there will be no parsing of the data (because it's not part of a query string), and that the structure of the query is fixed when the prepared statement is parsed and cannot be altered by injection.

So, yes, a prepared statement definitely increases safety.

It also means you do not have to incur the parsing overhead if you reuse a prepared statement for several requests.