binding variables to parameters in ADOdb for PHP

Question

does binding variables to parameters in ADOdb for PHP prevent SQL injection in any way? I thought ADOdb also did data sanitation or escaping within the same functionality by default. Or am I just confusing it with Code Igniter's built-in processes?

Answer 1

Correct - bound parameters are not vulnerable to SQL injection attacks.

Answer 2

Thanks, I've been using them for a while and over the weekend a client came to me in a panic saying I was not validating data before processing and they didn't believe me that ADOdb was doing it for me.

Granted the extra level of security wouldn't hurt.