Are there any best practices for handling database queries and data retrieval in PHP scripts?

When handling database queries and data retrieval in PHP scripts, it is important to use prepared statements to prevent SQL injection attacks and ensure data security. Additionally, it is recommended to separate database connection logic into a separate file for reusability and maintainability. 

// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Use prepared statements for database queries
$stmt = $conn->prepare("SELECT id, name FROM users WHERE id = ?");
$stmt->bind_param("i", $id);

$id = 1;
$stmt->execute();
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    echo "ID: " . $row['id'] . " Name: " . $row['name'] . "<br>";
}

$stmt->close();
$conn->close();

Keywords

SQL injection PDO prepared statements data sanitization database optimization

Related Questions