I have run into a bit of a dilemma.  Binding user input and building a prepared statement is all well and good, but what if I need the user input as a variable for a compare?Can I just create a function to clean the input?This is the line that worries me:$password = $_POST['password']What I have working so far:// QUERYpublic function query($query){    $this->stmt = $this->dbh->prepare($query);}// RESULT SETpublic function resultset(){$this->execute();    return $this->stmt->fetchAll(PDO::FETCH_ASSOC);}// EXECUTEpublic function execute(){    return $this->stmt->execute();}Check that the password matches with the database password if username exists<?phpif (isset($_POST['login'])) {    $dbpass = '';    $password = $_POST['password'];    //Select username, password, salt and active    $database->query('SELECT username, password, salt, active FROM wcx_admin WHERE username = :username');    $database->bind(':username', $_POST['username']);    $rows = $database->resultset();    if(isset($rows[0])) {        $salt = $rows[0]['salt'];        $dbpass = $rows[0]['password'];        $password = hash(sha512, $password . $salt);    }    if($password !== $dbpass) {        echo 'Incorrect Username or Password';    } }?>Binding Function// BINDpublic function bind($param, $value, $type = null){if (is_null($type)) {    switch (true) {        case is_int($value):            $type = PDO::PARAM_INT;            break;        case is_bool($value):            $type = PDO::PARAM_BOOL;            break;        case is_null($value):            $type = PDO::PARAM_NULL;            break;        default:            $type = PDO::PARAM_STR;    }}$this->stmt->bindValue($param, $value, $type);}
Login system, PDO and me
php;pdo;authentication