From 97d9dc0404fe5509bf341335a46d36fe21b6a952 Mon Sep 17 00:00:00 2001 From: Nat Zimmermann Date: Wed, 27 Feb 2019 19:52:08 +0000 Subject: [PATCH] Encourage using prepared statements --- doc/recipes.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/recipes.rst b/doc/recipes.rst index 89fffc366..93db2c664 100644 --- a/doc/recipes.rst +++ b/doc/recipes.rst @@ -409,8 +409,8 @@ First, let's create a temporary in-memory SQLite3 database to work with:: {% block content %}Hello {{ name }}{% endblock %} '; $now = time(); - $dbh->exec("INSERT INTO templates (name, source, last_modified) VALUES ('base.twig', '$base', $now)"); - $dbh->exec("INSERT INTO templates (name, source, last_modified) VALUES ('index.twig', '$index', $now)"); + $dbh->prepare('INSERT INTO templates (name, source, last_modified) VALUES (?, ?, ?)')->execute(['base.twig', $base, $now]); + $dbh->prepare('INSERT INTO templates (name, source, last_modified) VALUES (?, ?, ?)')->execute(['index.twig', $index, $now]); We have created a simple ``templates`` table that hosts two templates: ``base.twig`` and ``index.twig``.