MYSQL间隔查询SQL注入

Question

I have this simple MYSQL query:

SELECT * FROM table WHERE date > now() - INTERVAL $hours HOUR

$hours is a PHP GET variable. Do I have to do any check on this variable before using it in the query to avoid SQL injection or is it secure enough? I use PDO statements

Answer 1

Something like this would be good:

$sth = $Db->dbh->prepare("SELECT * FROM 'table' WHERE date > now() - INTERVAL :hours"); $sth->execute(array(':hours'=>$hours,':secondThing'=>$variable));

That's a way to esacpe your strings. This can be different from your code but the array in the execute and query will be the same (if you use PDO.)