How can one prevent SQL injection when working with MySQL data in PHP?

To prevent SQL injection when working with MySQL data in PHP, you should always use prepared statements with parameterized queries. This approach ensures that user input is treated as data rather than executable SQL code, thus preventing malicious SQL injection attacks. 

// Establish a connection to the database
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection MySQL PHP prepared statements parameterized queries

Related Questions