How can PDO and Prepared Statements be used together to prevent SQL injections in PHP?

To prevent SQL injections in PHP, PDO can be used in conjunction with prepared statements. Prepared statements allow for the separate processing of SQL query and user input, preventing malicious SQL code from being executed. By using placeholders in the SQL query and binding user input to these placeholders, PDO ensures that input is treated as data rather than executable code. 

// Establish a connection to the database using PDO
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind user input to the placeholders
$username = $_POST['username'];
$stmt->bindParam(':username', $username);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

PDO Prepared Statements SQL injections PHP Security

Related Questions