Are there any best practices for handling database queries and storing results in PHP?

When handling database queries in PHP, it is important to properly sanitize user input to prevent SQL injection attacks. Additionally, it is recommended to use prepared statements to execute queries safely and efficiently. Storing query results in PHP can be done using arrays or objects to easily access and manipulate the data. 

// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare and execute a query using prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

$username = "john_doe";
$stmt->execute();

$result = $stmt->get_result();

// Store query results in an array
$users = array();
while ($row = $result->fetch_assoc()) {
    $users[] = $row;
}

// Close the connection
$stmt->close();
$conn->close();

// Access and manipulate the stored data
foreach ($users as $user) {
    echo $user['username'] . "<br>";
}

Keywords

SQL injection PDO prepared statements mysqli error handling

Related Questions