准备好的陈述 - 我是否应该在没有（？）占位符的查询中使用php预处理语句？

Question

It makes perfect sense to me to use prepared statements in a query of the following type:

$sqlQuery = "SELECT phone FROM contact WHERE name = ? ";

However, in the following situation, does it make sense and is it useful to use prepared statements, as sometimes seen?

$sqlQuery = "SELECT name FROM contact";

Thanks in advance

Answer 1

If you are running a query without any user-entered variables, you can just do:

$db->query("SELECT name FROM contact")

As soon as you start entering in user-inputted data, then you need to use a prepared statement.

$db->prepare("SELECT phone FROM contact WHERE name = ?");