title: PDO Prepared Statement Function
body: <p>I am using PDO prepared statements, while working on my current project i decided to just create several function for each action that i would need. Below is the example for fetch</p>
  
  <pre><code>function db_fetchAll($sql, $param) {
      global $db;
  
      $stmt = $db-&gt;prepare($sql);
  
      if (empty($param)) {
          $stmt-&gt;execute();
      } else {
          $stmt-&gt;execute($param);
      }
  
      $count = $stmt-&gt;rowCount();
  
      if ($count == 0) {
          $result = "";
      } elseif ($count == 1) {
          $result[] = $stmt-&gt;fetch();
      } elseif ($count &gt; 1) {
          $result = $stmt-&gt;fetchAll();
      }
  
      return $result;
  }
  </code></pre>
  
  <p>Example </p>
  
  <pre><code>$database = db_fetchAll("SELECT * FROM database_table WHERE id=:id", array(':id' =&gt; $id));
  </code></pre>
  
  <p>It only condenses lines query's from 3 lines to 1, but with the amount of information required for each page it was worth condensing. </p>
  
  <p>I am going back through the project for one final pass through and i just wanted a second opinion on the security of this. If there is anything that i should add, etc. All user_input is passed through this function</p>
  
  <pre><code>function user_input($input) {
      $input = trim($input);  
      $output = strip_tags($input);
  
      return $output;
  }
  </code></pre>
  
  <p>and all output uses htmlspecialchars.</p>
  
  <p>So the question in a nutshell is:
  Is this safe?
  Is there anything else that i could do to prevent any other form of injection etc?</p>
  
  <p>I completely understand how prepared statements work, i am just being thorough, version 1 of this site was a nightmare, tons of injections, gaining access to admin accounts, etc. </p>