PHP MySQLi Prepared Statements: Can this select query be hacked/injected?

Question

i want to know can this be hacked/injected?

$stmt = $mysqli->prepare("SELECT * FROM myTable WHERE name = ?");
$stmt->bind_param("s", $_POST['name']);
$stmt->execute();
$result = $stmt->get_result();
if($result->num_rows === 0) exit('No rows');
while($row = $result->fetch_assoc()) {
 //do some stuff
}
var_export($ages);
$stmt->close();

Answer 1

Given an answer on Stack Overflow suggests almost identical code for protection, let alone using exactly the same principle you can safely assume that your query is protected.

If you want to know how it works, I also wrote an answer on Stack Overflow, https://stackoverflow.com/a/8265319/285587

Nevertheless, as this site is for the code reviews offering some suggestions, I would suggest to use PDO for database interactions instead of mysqli. Simply because PDO API is much more versatile and easier to use. see your snippet rewritten in PDO:

$stmt = $mysqli->prepare("SELECT * FROM myTable WHERE name = ?");
$stmt->execute([$_POST['name']]);
if($stmt->rowCount() === 0) exit('No rows');
while($row = $stmt->fetch_assoc()) {
 //do some stuff
}

as you can see some nagging operations are just gone. I wrote a tutorial on PDO, which I would quite expectedly recommend.