Prepared statements in PHP I just heard of prepared statement in PHP and decided to prevent SQL injection with it and wrote a script testing it.

I would like to know what security threats this script can prevent, what security threats this script is vulnerable to, and how these threats are blocked.

&lt;?php
require_once ("db.php");
$db = new MyDB();
session_start();

if (isset($_POST['userMsgField']) &amp;&amp; !empty($_POST['userMsgField']) || isset($_POST['hash']) &amp;&amp; !empty($_POST['hash']))
{
$my_id = $_SESSION['log_id'];
$rep_msg = $_POST['userMsgField'];
$hash = $_SESSION['hash'];
$flag = 0;

$sql =&lt;&lt;&lt;EOF
SELECT * FROM connect WHERE (user_one = '$my_id' AND hash = '$hash') OR (user_two = '$my_id' AND hash = '$hash');
EOF;

$ret = $db-&gt;query($sql);

while ($row = $ret-&gt;fetchArray(SQLITE3_ASSOC))
{
    $user_one = $row['user_one'];
    $user_two = $row['user_two'];

    if ($user_one == $my_id)
    {
        $to_id = $user_two;
    }
    else
    {
        $to_id = $user_one;
    }


    $isql =&lt;&lt;&lt;EOF
    INSERT INTO messager (message, group_hash, from_id, flag, to_id) VALUES (:message, :group_hash, :from_id, :flag, :to_id);
EOF;
    $bsql =&lt;&lt;&lt;EOF
    INSERT INTO chatportal (message, group_hash, from_id, flag, to_id) 
VALUES (:message, :group_hash, :from_id, :flag, :to_id);
EOF;

    $stmt = $db-&gt;prepare($isql);
    $bstmt = $db-&gt;prepare($bsql);

    $stmt-&gt;bindValue(':message', $rep_msg, SQLITE3_TEXT);
    $stmt-&gt;bindValue(':group_hash', $hash, SQLITE3_INTEGER);
    $stmt-&gt;bindValue(':from_id', $my_id, SQLITE3_INTEGER);
    $stmt-&gt;bindValue(':flag', $flag, SQLITE3_INTEGER);
    $stmt-&gt;bindValue(':to_id', $to_id, SQLITE3_TEXT);

    $bstmt-&gt;bindValue(':message', $rep_msg, SQLITE3_TEXT);
    $bstmt-&gt;bindValue(':group_hash', $hash, SQLITE3_INTEGER);
    $bstmt-&gt;bindValue(':from_id', $my_id, SQLITE3_INTEGER);
    $bstmt-&gt;bindValue(':flag', $flag, SQLITE3_INTEGER);
    $bstmt-&gt;bindValue(':to_id', $to_id, SQLITE3_TEXT);

    $result = $stmt-&gt;execute();
    $bresult = $bstmt-&gt;execute();

    if ($reuslt &amp;&amp; $bresult)
    {

    }
}
}
Non-review answers


what security threats this script can prevent - sql injection 
what security threats this script is vulnerable to - sql injection
how these threats are blocked - https://stackoverflow.com/questions/8263371/how-can-prepared-statements-protect-from-sql-injection-attacks


Review answer.

Your code is bloated with unnecessary operators, such as heredoc. 
It is also recommended to use PDO instead of sqlite, as it will let you to use array binding, which is especially useful in this case as you are inserting equal sets of data.

Besides, you should use prepared statements for your database interactions.

There are also other improvements and fixes.

if (!empty($_POST['userMsgField']) &amp;&amp; !empty($_POST['hash']))
{
    $my_id = $_SESSION['log_id'];
    $rep_msg = $_POST['userMsgField'];
    $hash = $_POST['hash'];
    $flag = 0;

    $sql = "SELECT * FROM connect WHERE (user_one = ? AND hash = ?) 
                                     OR (user_two = ? AND hash = ?)";
    $stmt = $db-&gt;prepare($sql);
    $stmt-&gt;execute([$my_id,$hash,$my_id,$hash]);

    while ($row = $stmt-&gt;fetch(PDO::FETCH_ASSOC))
    {
        $user_one = $row['user_one'];
        $user_two = $row['user_two'];

        $to_id = ($user_one == $my_id) ? $user_two : $user_one;

        $data = [
            'message' =&gt; $rep_msg,
            'group_hash' =&gt; $hash,
            'from_id' =&gt; $my_id,
            'flag' =&gt; $flag,
            'to_id' =&gt; $to_id,
        ];

        $sql ="INSERT INTO messager (message, group_hash, from_id, flag, to_id) 
                            VALUES (:message,:group_hash,:from_id,:flag,:to_id)";
        $db-&gt;prepare($sql)-&gt;execute($data);

        $sql ="INSERT INTO chatportal (message, group_hash, from_id, flag, to_id)
                              VALUES (:message,:group_hash,:from_id,:flag,:to_id)";
        $db-&gt;prepare($sql)-&gt;execute($data);
    }
}


Now this code is much cleaner and easier to read. And safe, of course.