I'm trying to fetch and convert data into JSON format. Some days ago I was using MySQLi but someone told me this is susceptible to SQL injections when I asked a question for code review. Now I'm trying to use PDO.
PHP MySQLi (OOP-based)
$CompanyRes = array();
$Company = "select * from `ws_company` where `cm_status` = 1";
$CompanyQuery = mysqli_query($this->connection,$Company);
while($rowCom = mysqli_fetch_assoc($CompanyQuery)){
$CompanyRes[] = $rowCom;
}
PDO-based
$CompanySts=$this->pdoConnection->prepare("select * from `ws_company` where `cm_status` = 1");
$CompanySts->execute();
header("Content-type: application/json; charset=utf-8");
$CompanyRes = array();
while ($row = $CompanySts->fetch(PDO::FETCH_ASSOC)) {
$CompanyRes[] = array_map('utf8_encode', $row);
}
Both are same work for me, but I wanted to know if the second one is correct or not, and if I'm missing something.
