Mysql PDO

[13ran]

How can I safetly use user submitted parameters in the query? Is there a way to bind them?

[n1crack]

Hi,

You can use :

    $path = dirname(__DIR__).'/database/Chinook_Sqlite_AutoIncrementPKs.sqlite';

    $dt = new Ozdemir\Datatables\Datatables(new Ozdemir\Datatables\DB\SQLite($path));
    $dt->query('Select TrackId, Name, UnitPrice from Track where TrackId < :trackid')->escape('trackid', 4);

    return $dt->generate();

or (added v.2.3.10)

    $path = dirname(__DIR__).'/database/Chinook_Sqlite_AutoIncrementPKs.sqlite';

    $dt = new Ozdemir\Datatables\Datatables(new Ozdemir\Datatables\DB\SQLite($path));
    $dt->query('Select TrackId, Name, UnitPrice from Track where TrackId < :trackid', ['trackid' => 4]);

    return $dt->generate();

[13ran]

Thank you!