title: Does pg_prepare() prepared statement (not PDO) prevent SQL-Injection?
body: <p><strong>PDO ist not supported in target system I'm working on</strong> and though I seek a solution for preventing SQL-Injection using <strong>PHP 5.1.x</strong> on a <strong>PostGres-DB 8.2+</strong>. There is at the moment <strong>no</strong> chance of switching to PDO.</p>
  
  <p>My solution at the moment is pg_prepare-prepared statement:</p>
  
  <pre><code>// Trying to prevent SQL-Injection
  $query = 'SELECT * FROM user WHERE login=$1 and password=md5($2)';
  $result = pg_prepare($dbconn, "", $query);
  $result = pg_execute($dbconn, "", array($_POST["user"], $_POST["password"]));
  if (pg_num_rows($result) &lt; 1) {
    die ("failure");
  }
  </code></pre>
  
  <p><strong>But pg_prepare-documentation lacks about an important information:</strong></p>
  
  <p><strong>it tells about "later usage"</strong></p>
  
  <blockquote>
    <p>pg_prepare() creates a prepared statement for later execution with
    pg_execute() or pg_send_execute().[...]</p>
  </blockquote>
  
  <p><strong>it tells about "named/anonymous statements"</strong></p>
  
  <blockquote>
    <p>The function creates a prepared statement named stmtname from the
    query string, which must contain a single SQL command. stmtname may be
    "" to create an unnamed statement, in which case any pre-existing
    unnamed statement is automatically replaced;[...]</p>
  </blockquote>
  
  <p><strong>it tells about "typecasting"</strong></p>
  
  <blockquote>
    <p>Prepared statements for use with pg_prepare() can also be created by
    executing SQL PREPARE statements. (But pg_prepare() is more flexible
    since it does not require parameter types to be pre-specified.) Also,
    although there is no PHP function for deleting a prepared statement,
    the SQL DEALLOCATE statement can be used for that purpose.</p>
  </blockquote>
  
  <p><strong>but it does not tell, if this implementation of prepared statements is safe from SQL-injection</strong></p>
  
  <p>*Nearly all comments by this security question refers to the PDO-solution, where in documentation is noticed that the driver prevents SQL-injection. But if an easy solution may be pg_prepare, I would use pg_prepare at the moment.*</p>
  
  <p>Thanks for this important information of maybe a best practice solution.</p>
  
  <p><strong>EDIT (after marked as solution):</strong>
  Thanks for very enlightening answers!</p>
  
  <ul>
  <li>I marked the solution of Frank Heikens as best answer, cause it explains an important point in SQL-injection. A programmer may use prepared statemtents, but the SQL-injection-lack may still be there by mistake!</li>
  <li>Aside from Frank Heikens answer, hoppa shows that the SQL-injection is prevented using pg_prepare/pg_query_params. Thanks though.</li>
  <li>Will now use an optimized code with <code>pg_query_params</code> (thanks to Milen A. Radev)</li>
  <li>And <code>pg_escape_string()</code> as alternative when it comes to it (thanks to halfer)</li>
  </ul>
  
  <p>All answers are helpfully :)</p>
  
  <pre><code>// Trying to prevent SQL-Injection (**updated**)
  $sql_query = 'SELECT * FROM user WHERE login=$1 and password=md5($2);';
  $result = pg_query_params($dbconn_login, $sql_query, array($_POST["user"], $_POST["password"]));
  if (pg_num_rows($result) &lt; 1) {
    die('failure');
  }
  </code></pre>