Skip to content
PHP Logo

How can one prevent SQL injections in PHP scripts, as mentioned in the forum thread?

SQL injections can be prevented in PHP scripts by using prepared statements with parameterized queries instead of directly inserting user input into SQL queries. This helps to sanitize and validate user input, preventing malicious SQL code from being executed.

php 
// Establish a connection to the database
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders for parameters
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the parameters
$stmt->bindParam(':username', $_POST['username']);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Related questions