How can one secure PHP code against injections?

To secure PHP code against injections, one should use prepared statements with parameterized queries when interacting with a database. This helps to prevent SQL injection attacks by separating the SQL query logic from the user input data. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input data to the placeholders
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection prepared statements parameterized queries input validation PDO.

Related Questions