Using filter_var() Sanitize with Pdo, do I need to use statements?

Asked

Viewed 64 times

0

I wonder if even using filter_var with Sanitize you need to use Pdo statements.

Is it safe to do so? or do I need to use bindValue for example()

<?php

$con=conectar();

//Recebe número da pagina, caso não exista recebe valor 1
$pg = (isset($_GET['pg'])) ? filter_var($_GET['pg'], FILTER_SANITIZE_NUMBER_INT) : 1;

//Variaveis
$polo = isset($_GET['polo']) ? filter_var($_GET['polo'], FILTER_SANITIZE_NUMBER_INT) : null;
$tipo = isset($_GET['tipo']) ? filter_var($_GET['tipo'], FILTER_SANITIZE_NUMBER_INT) : null;

//Config paginação
$limite = 2;
$inicio = ($pg*$limite) - $limite;

if(!empty($polo) && empty($tipo)) {

    $consulta = "SELECT * FROM cursos WHERE polo = $polo ORDER BY nome ASC LIMIT $inicio, $limite";
    $contador = $con->query("SELECT count(*) FROM cursos WHERE polo = $polo")->fetchColumn();

}else if(empty($polo) && !empty($tipo)) {

    $consulta = "SELECT * FROM cursos WHERE tipo = $tipo ORDER BY nome ASC LIMIT $inicio, $limite";
    $contador = $con->query("SELECT count(*) FROM cursos WHERE tipo = $tipo")->fetchColumn();

}else if (empty($polo) && empty($tipo)) {

    $consulta = "SELECT * FROM cursos ORDER BY nome ASC LIMIT $inicio, $limite";
    $contador = $con->query("SELECT count(*) FROM cursos")->fetchColumn();

}else {

    $consulta = "SELECT * FROM cursos WHERE polo = $polo AND tipo = $tipo ORDER BY nome ASC LIMIT $inicio, $limite";
    $contador = $con->query("SELECT count(*) FROM cursos WHERE polo = $polo AND tipo = $tipo")->fetchColumn();

}

$puxa_cursos = $con->prepare($consulta);
$puxa_cursos->execute();
  • I think the question could be reversed, why not use?

  • To avoid writing lines of code that you may not need, I thought I was clear in the question.

No answers

Browser other questions tagged

You are not signed in. Login or sign up in order to post.