哪个是在php中绑定param的最好的安全方法[关闭]

Question

which is the best secure way to bind a value ? I know that there are 3 ways

1.

$Email=$con->quote($Email);
$Example=$con->prepare("UPDATE Ex SET Email=:Email");
$Example->bindParam(':Email', $Email);
$Example->execute();

2.

$Email=$con->quote($Email);
$Example=$con->prepare("UPDATE Ex SET Email=:Email");
$Example->execute(array(
   ':Email' => $Email,
));

3.

$Email=$con->quote($Email);
$Example=$con->prepare("UPDATE Ex SET Email=:Email");
$Example->bindParam(':Email', $Email);
$Example->execute(array(
   ':Email' => $Email,
));

Answer 1

They're all wrong. Since you're separately using quote, the final query will actually be equivalent to (assuming $Email is, say [e-mail]):

UPDATE Ex SET Email="\"[e-mail]\""

In other words, the quotes become part of the value, which is probably not what you want.

Either of these will do just fine:

$Example = $con->prepare('UPDATE Ex SET Email = :Email');
$Example->execute(array(':Email' => $Email));

$Example=$con->prepare('UPDATE Ex SET Email = :Email');
$Example->bindParam(':Email', $Email);
$Example->execute();

Doing both bindParam and passing an array to execute is nonsense, since the latter will simply override the former and bindParam will have been superfluous.