This question already has an answer here:
I was wondering if I'm safe from SQL injection if I have this in a script:
< script>
//some stuff
var item = <?php echo json_oncode($PHPVAR) ?>
item.replace(/"/,'"').replace(/'/,''');
//do more script stuff with item
< /script>
currently using Laravel (PHP), with PDO Are there anything else that I should be aware of/look out for? (I didn't whitelist/blacklist before submitting to database b/c PDO does that for me from what I understand)
Also I'm asking b/c item is taken from a user input and it dynamically creates HTML using the value of item
Best How To :
The question is somewhat unanswerable (atleast not in a way that will not give you a false sense of security) with the amount of resource provided.
Since you are using PDO I'll go right ahead and say that you ought to be using prepared statements. Injection on a whole primarily lies on how the Web Application handles user input.
Your question should be, "How does this piece of user input interact with my application?" -- ofcourse there isn't a set list of things to do in order to keep yourself protected from (B)SQLi (or other variants of Injection [XSS/LDAP]).
The following are some good resources that will help you out further with regards to SQL Injection on a whole (you need to know how the vulnerability works in general if you want to be able to cover something specific).
OWASP SQL Injection
Acunetix SQL Injection
SQL Injection Cheat Sheet
There isn't much more to specifically answer your question except maybe go deeper into how to handle user input with regards to the code you have provided (which we may but I don't think is required).
