Search code examples
phppdosql-injectiontruncate

Is it safe to truncate a table without using a prepared statement?

I've used the following sort of code a few times in my current project to clear out some tables. Incase it's not obvious I'm using PDO.

 $clearResult = $db->query('TRUNCATE TABLE table_name');

I'm currently going through and updating a few of my earlier scripts to make sure they all make use of prepared statements and are written in a way to reduce (hopefully stop) sql injection.

Solution

  • No, there's no user input in the actual query so there's no risk of injection.

    You do have to make sure that a user isn't able to trigger the truncate though, unless they're authorized.