PHP MySQL Prepared Statements

[scotty86]

Hello,

https://www.w3schools.com/php/php_mysql_prepared_statements.asp says

Quote

Prepared statements are very useful against SQL injections.

That's true, but it might worth mentioning, that setting a charset (e.g. $conn->set_charset("utf8")) is important, since it can make prepared statements vulnerable to injections. 

For an example injection and explanation take a look here: https://stackoverflow.com/a/12202218/1988569

Stay safe,
scotty86