Is it possible to hack PHP PDO ?

[rufusshinra]

I think php pdo query with prenthesis around them is safe from sql injection.
"select * from users where id=(:id)"
Do you agree or disagree with this statement?

[[s]]

Hi ,

The simple answer to this question is NO. The Parameterized or prepared statements are usually good enough to prevent SQL injection but not fully. If you do not set the character encoding type, then it is possible to break the query.

Example Vulnerable code :

$pdo->query('SET NAMES gbk');
$var = "\xbf\x27 OR 1=1 /*";
$query = 'SELECT * FROM test WHERE name = ? LIMIT 1';
$stmt = $pdo->prepare($query);
$stmt->execute(array($var));

Now, it's worth noting that you can prevent this by disabling emulated prepared statements

$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

I hope this is helpful for you.