Do I still Need To Use Prepared Statement [duplicate]

Question

Using PHP and MySQLi I have a simple form with 4 HTML 5 Dropdown Select list inputs. Now wondering do I still have to use Prepared Statement to secure my database? Am I still in the risk of SQL Injection issues? Or is there any other type of risk for using this type of inputs. Thanks

Answer 1

You are still wide open for an injection attack since the value inserted through your select box could easly be modifed by the end user.

If you have a good validation server side, then doing it without prepared statement would work.

With good i mean something like this:

$array = Array("all", "your", "possible", "values", "from", "Select boxes");
if(in_array ($_POST['selectbox'], $array)){
      //Mysql statements etc....
}

Directly inserting user input is NEVER a good idea. You should never trust the end user!