Are there any security considerations to keep in mind when fetching and displaying user data from a MySQL table in PHP?

When fetching and displaying user data from a MySQL table in PHP, it is important to sanitize the data to prevent SQL injection attacks. This can be done by using prepared statements or parameterized queries to bind user input to query parameters. Additionally, it is recommended to validate and escape user input before displaying it to prevent cross-site scripting attacks. 

// Establish a connection to the MySQL database
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');

// Fetch user data from the database using prepared statements
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
$stmt->bindParam(':id', $_GET['user_id']);
$stmt->execute();
$userData = $stmt->fetch(PDO::FETCH_ASSOC);

// Sanitize and display user data
echo htmlspecialchars($userData['username']);
echo htmlspecialchars($userData['email']);

Keywords

SQL injection data validation prepared statements XSS attacks encryption

Related Questions