PHP PDO clean user input

Question

I've been looking into the most efficient method of cleaning user input. My application is a simple post request that is used to authenticate a user. Looking online I can find more then a dozen different "best" methods of doing this. A lot of these methods use deprecated php functions or seem overly complicated. In order to connect to my sql database I use the PDO class.

While searching for my own functions I stumbled accross this:

Prepared statements with bound parameters are not only more portable, more convenient, immune to SQL injection, but are often much faster to execute than interpolated queries, as both the server and client side can cache a compiled form of the query.

I already use the prepare method to create my statement. Does this mean I'm safe against SQL injection attacks? What else should I be worried about?

Answer 1

If you bind ALL user data via prepared statements with PDO you should be safe from injection. Any variables you put into your SQL statement (like sort order) that you do not bind, is an open vector for attack.

Answer 2

@Ray already answered the first part of the question. For the second part, since you're authenticating your users you should also be worried about how you store their passwords, use some one-way cryptographic hash for that with a salt. And check if calculating the hash again from the user-entered password using the original salt matches the database entry. If possible use https for the authentication step as well.