@@ -254,9 +254,13 @@ an individual blog result based on a given id::
254254 function get_post_by_id($id)
255255 {
256256 $link = open_database_connection();
257- $id = intval($id);
258- $result = $link->query('SELECT created_at, title, body FROM post WHERE id = '.$id);
259- $row = $result->fetch(PDO::FETCH_ASSOC);
257+
258+ $query = 'SELECT created_at, title, body FROM post WHERE id=:id';
259+ $statement = $link->prepare($query);
260+ $statement->bindValue(':id', $id, PDO::PARAM_INT);
261+ $statement->execute();
262+
263+ $row = $statement->fetch(PDO::FETCH_ASSOC);
260264
261265 close_database_connection($link);
262266
@@ -294,9 +298,7 @@ Creating the second page is now very easy and no code is duplicated. Still,
294298this page introduces even more lingering problems that a framework can solve
295299for you. For example, a missing or invalid ``id `` query parameter will cause
296300the page to crash. It would be better if this caused a 404 page to be rendered,
297- but this can't really be done easily yet. Worse, had you forgotten to clean
298- the ``id `` parameter via the ``intval() `` function, your
299- entire database would be at risk for an SQL injection attack.
301+ but this can't really be done easily yet.
300302
301303Another major problem is that each individual controller file must include
302304the ``model.php `` file. What if each controller file suddenly needed to include
@@ -417,7 +419,7 @@ content:
417419
418420 {
419421 "require" : {
420- "symfony/symfony" : " 3.0 .*"
422+ "symfony/symfony" : " 3.1 .*"
421423 },
422424 "autoload" : {
423425 "files" : [" model.php" ," controllers.php" ]
0 commit comments