How can one avoid SQL injection vulnerabilities when writing PHP queries?

SQL injection vulnerabilities can be avoided in PHP queries by using prepared statements with parameterized queries. This approach separates the SQL query logic from the user input, preventing malicious input from being executed as SQL code. 

// Using prepared statements to avoid SQL injection vulnerabilities
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL query with a placeholder for the user input
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

Prepared statements PDO mysqli_real_escape_string input validation parameterized queries

Related Questions