PHP和mySQLi:使用prepare语句时是否还需要检查用户输入？

Question

如果我在mySQLi中使用prepare语句,我是否仍然需要以任何方式转义或检查用户输入.例如,如果我有代码:

$members = new mysqli("localhost", "user", "pass", "members");
$r_email = $_POST['r_email'];
$check = $members->prepare("select user_id from users where email = ?");
$check->bind_param('s', $r_email);
$check->execute();
$check->store_result();
if ($check->num_rows > 0) {
    echo "user already registered";
    $check->close();
}
$members->close();

我需要改变$r_email = $_POST['r_email'],以$r_email = mysql_real_escape_string($_POST['r_email']);

谢谢.

Answer 1

您不需要使用预准备语句进行转义,但验证用户输入仍然是一个好主意(例如,已填充必填字段,数字字段包含数值等)