@@ -254,9 +254,13 @@ an individual blog result based on a given id::
254
254
function get_post_by_id($id)
255
255
{
256
256
$link = open_database_connection();
257
- $id = intval($id);
258
- $result = $link->query('SELECT created_at, title, body FROM post WHERE id = '.$id);
259
- $row = $result->fetch(PDO::FETCH_ASSOC);
257
+
258
+ $query = 'SELECT created_at, title, body FROM post WHERE id=:id';
259
+ $statement = $link->prepare($query);
260
+ $statement->bindValue(':id', $id, PDO::PARAM_INT);
261
+ $statement->execute();
262
+
263
+ $row = $statement->fetch(PDO::FETCH_ASSOC);
260
264
261
265
close_database_connection($link);
262
266
@@ -294,9 +298,7 @@ Creating the second page is now very easy and no code is duplicated. Still,
294
298
this page introduces even more lingering problems that a framework can solve
295
299
for you. For example, a missing or invalid ``id `` query parameter will cause
296
300
the page to crash. It would be better if this caused a 404 page to be rendered,
297
- but this can't really be done easily yet. Worse, had you forgotten to clean
298
- the ``id `` parameter via the ``intval() `` function, your
299
- entire database would be at risk for an SQL injection attack.
301
+ but this can't really be done easily yet.
300
302
301
303
Another major problem is that each individual controller file must include
302
304
the ``model.php `` file. What if each controller file suddenly needed to include
0 commit comments