<?php
// ✅ SAFE: Parameterized query with positional placeholders
$db = fbird_connect('localhost:/path/to/database.fdb', 'SYSDBA', 'masterkey');

$username = $_POST['username'];  // Untrusted user input
$active = 1;

// Prepare the statement with ? placeholders
$stmt = fbird_prepare($db, "SELECT id, email FROM users WHERE username = ? AND active = ?");

// Execute with parameters - input is NEVER parsed as SQL
$result = fbird_execute($stmt, $username, $active);

while ($row = fbird_fetch_assoc($result)) {
    echo "User: {$row['ID']}, Email: {$row['EMAIL']}\n";
}

fbird_free_result($result);
fbird_free_query($stmt);
fbird_close($db);

<?php
$stmt = fbird_prepare($db, "INSERT INTO users (username, email, created_at) VALUES (?, ?, ?)");

// All user input safely bound as literal values
$result = fbird_execute($stmt, 
    $_POST['username'],
    $_POST['email'],
    date('Y-m-d H:i:s')
);

if ($result) {
    echo "User created successfully";
}

<?php
$stmt = fbird_prepare($db, "UPDATE users SET email = ?, updated_at = ? WHERE id = ?");
$result = fbird_execute($stmt, $_POST['email'], date('Y-m-d H:i:s'), (int)$_GET['id']);

<?php
$stmt = fbird_prepare($db, "DELETE FROM sessions WHERE user_id = ? AND token = ?");
$result = fbird_execute($stmt, $userId, $_COOKIE['session_token']);

<?php
$ids = [1, 5, 10, 25];  // From user selection

// Build placeholders dynamically
$placeholders = implode(', ', array_fill(0, count($ids), '?'));
$sql = "SELECT * FROM products WHERE id IN ($placeholders)";

$stmt = fbird_prepare($db, $sql);

// Pass array elements as separate arguments
$result = fbird_execute($stmt, ...$ids);

<?php
$userInput = "O'Brien";
$escaped = fbird_escape_string($userInput);
// Result: "O''Brien" (single quote doubled)

// Safe to use in query (but parameterized queries are still preferred)
$sql = "SELECT * FROM users WHERE lastname = '$escaped'";

<?php
// Dynamic table name - CANNOT use parameters
$tableName = 'users_' . date('Y');
// Validate against whitelist instead of escaping
$allowedTables = ['users_2024', 'users_2025'];
if (!in_array($tableName, $allowedTables, true)) {
    throw new InvalidArgumentException("Invalid table name");
}
$sql = "SELECT * FROM $tableName WHERE id = ?";
$stmt = fbird_prepare($db, $sql);
$result = fbird_execute($stmt, $userId);

// LIKE patterns with user input
$search = fbird_escape_string($_GET['search']);
$stmt = fbird_prepare($db, "SELECT * FROM products WHERE name LIKE ?");
$result = fbird_execute($stmt, "%{$search}%");

<?php
// Firebird uses double single-quotes for escaping, NOT backslash
$safe = fbird_escape_string("O'Reilly");  // Returns: O''Reilly

// Firebird identifiers use double quotes (case-sensitive)
$sql = 'SELECT * FROM "CaseSensitiveTable" WHERE id = ?';

// Firebird EXECUTE BLOCK (stored procedure syntax)
// Parameters work normally:
$stmt = fbird_prepare($db, "
    EXECUTE BLOCK (p_id INTEGER = ?)
    RETURNS (name VARCHAR(100))
    AS
    BEGIN
        FOR SELECT name FROM users WHERE id = :p_id INTO :name DO
            SUSPEND;
    END
");

<?php
// ❌ UNSAFE - SQL Injection vulnerable
function unsafeLogin($db, $username, $password) {
    $sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
    $result = fbird_query($db, $sql);
    return fbird_fetch_assoc($result);
}
// Attack: username = "admin'--" bypasses password check!

// ✅ SAFE - Parameterized query
function safeLogin($db, $username, $password) {
    $stmt = fbird_prepare($db, 
        "SELECT id, username, password_hash FROM users WHERE username = ?");
    $result = fbird_execute($stmt, $username);
    $user = fbird_fetch_assoc($result);
    
    if ($user && password_verify($password, $user['PASSWORD_HASH'])) {
        return $user;
    }
    return false;
}

<?php
// ❌ UNSAFE - Injection via search term
function unsafeSearch($db, $term) {
    $sql = "SELECT * FROM products WHERE name LIKE '%$term%'";
    return fbird_query($db, $sql);
}
// Attack: term = "%' UNION SELECT username, password, 1 FROM users--"

// ✅ SAFE - Parameterized LIKE
function safeSearch($db, $term) {
    $stmt = fbird_prepare($db, "SELECT * FROM products WHERE name LIKE ?");
    return fbird_execute($stmt, "%{$term}%");
}

// ✅ SAFER - With escaping for LIKE special characters
function saferSearch($db, $term) {
    // Escape SQL wildcards if needed
    $term = str_replace(['%', '_'], ['\%', '\_'], $term);
    $stmt = fbird_prepare($db, "SELECT * FROM products WHERE name LIKE ? ESCAPE '\\'");
    return fbird_execute($stmt, "%{$term}%");
}

<?php
// ❌ UNSAFE - Dynamic column name
function unsafeSort($db, $column, $direction) {
    $sql = "SELECT * FROM products ORDER BY $column $direction";
    return fbird_query($db, $sql);
}
// Attack: column = "price; DROP TABLE products--"

// ✅ SAFE - Whitelist validation
function safeSort($db, $column, $direction) {
    $allowedColumns = ['name', 'price', 'created_at'];
    $allowedDirections = ['ASC', 'DESC'];
    
    if (!in_array($column, $allowedColumns, true)) {
        $column = 'name';  // Default
    }
    if (!in_array(strtoupper($direction), $allowedDirections, true)) {
        $direction = 'ASC';
    }
    
    $sql = "SELECT * FROM products ORDER BY $column $direction";
    return fbird_query($db, $sql);
}

<?php
// ❌ UNSAFE - Building IN clause unsafely
function unsafeDeleteMultiple($db, $ids) {
    $idList = implode(',', $ids);  // User might inject: "1,2); DROP TABLE users;--"
    $sql = "DELETE FROM temp_items WHERE id IN ($idList)";
    return fbird_query($db, $sql);
}

// ✅ SAFE - Parameterized IN clause
function safeDeleteMultiple($db, array $ids) {
    // Validate all IDs are integers
    $ids = array_filter($ids, 'is_numeric');
    $ids = array_map('intval', $ids);
    
    if (empty($ids)) {
        return false;
    }
    
    $placeholders = implode(',', array_fill(0, count($ids), '?'));
    $sql = "DELETE FROM temp_items WHERE id IN ($placeholders)";
    $stmt = fbird_prepare($db, $sql);
    return fbird_execute($stmt, ...$ids);
}