# Is there sql injection in DoliDBMysqli

**URL:** <https://www.dolibarr.org/forum/t/is-there-sql-injection-in-dolidbmysqli/24841>\
**Category:** Developing for Dolibarr\
**Tags:** Security, Question, MySQL\
**Created:** [January 17, 2024, 11:13am UTC](https://www.dolibarr.org/forum/t/is-there-sql-injection-in-dolidbmysqli/24841 "2024-01-17T11:13:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![g.levoux](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/g/6bbea6/32.png) [@g.levoux](https://www.dolibarr.org/forum/u/g.levoux)\
**Post date:** [January 17, 2024, 11:13am UTC](https://www.dolibarr.org/forum/t/is-there-sql-injection-in-dolidbmysqli/24841/1 "2024-01-17T11:13:28Z")

</div>

Hi everyone,

I am creating a new PDF template and need to access the database to retrieve a value. Here’s my code:

```php
$propal_extrafields = $this->db->query("SELECT * FROM `llx_propal_extrafields` WHERE `fk_object`=".$object->id)->fetch_assoc();

```

I would prefer to use a prepared statement. Is that possible? Is DoliDBMysqli already protected against SQL injection?

Thanks !

---

<div class="post-metadata">

**Author:** ![MoisesVortice](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/m/f17d59/32.png) [@MoisesVortice](https://www.dolibarr.org/forum/u/MoisesVortice)\
**Post date:** [January 23, 2024, 10:26am UTC](https://www.dolibarr.org/forum/t/is-there-sql-injection-in-dolidbmysqli/24841/2 "2024-01-23T10:26:34Z")

</div>

Yes. You can prepare a statement, something like this:

```auto
$stmt = $db->db->prepare($sql);

```

and use this $stmt to bind parameters:

```auto
$stmt->bind_param(bind_login, ...$parameters);

```

See [https://www.php.net/manual/en/mysqli-stmt.bind-param.php](https://www.php.net/manual/en/mysqli-stmt.bind-param.php).