Data validation in PHP

Question

I am developing a project which I am using a structure somewhat similar to that of Laravel, this structure allows me to make a CRUD in the whole system using only one class and setting the tables I want to consult. The code below shows how I created, I made some basic validations but I do not know if in case it is necessary to validate the input parameters so that the query is not vulnerable against sql Injection or if the way it is is no longer vulnerable.

<?php

namespace SON\Db;

abstract class Table{
    protected $db;
    protected $table;

    public function __construct(\PDO $db){

        $this->db = $db;
    }   
    public function insert(array $data){
        $fields = '`' . implode('`, `', array_keys($data)) . '`';
        $fields_data   = ':' . implode(', :', array_keys($data));
        $stmt = $this->db->prepare("INSERT INTO {$this->table} ({$fields}) VALUES ({$fields_data})");
        if($stmt->execute($data)){
            return true;
             // cadastro efetuado com sucesso !
        }
        return false;
         // error  - email inválido
    }
?>

Answer 1

So dude, you’re basically adding the values right into sql, which means the data you enter there will be part of the query. Since you are not protecting yourself against this, it is possible to perform sql Injection. Therefore, you should do some validation process to avoid this.

Answer 2

Use a Framework you don’t have to worry so much about SQL Injection and Validations if you follow the Framework usage recommendations correctly.

Here are some that might be useful:

• Cake PHP
• Code Igniter
• Laravel
• Symfony

What is not lacking is Framework in the market.

There is no point in reinventing the wheel, even new Frameworks use old Frameworks structures, of course the license should be checked before using another Framework as a basis.