How can PDO be implemented in PHP to improve database security and prevent SQL injection?

To improve database security and prevent SQL injection in PHP, developers can implement the PDO (PHP Data Objects) extension. PDO provides a secure way to access databases by using prepared statements and parameterized queries, which help prevent SQL injection attacks. 

// Establish a connection to the database using PDO
$dsn = 'mysql:host=localhost;dbname=mydatabase';
$username = 'username';
$password = 'password';
$options = array(
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES => false
);

try {
    $pdo = new PDO($dsn, $username, $password, $options);
} catch (PDOException $e) {
    echo 'Connection failed: ' . $e->getMessage();
}

// Prepare a statement with placeholders
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind values to the placeholders and execute the query
$username = 'example';
$stmt->bindParam(':username', $username, PDO::PARAM_STR);
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Loop through the results
foreach ($results as $row) {
    echo $row['username'] . '<br>';
}

Keywords

PDO PHP database security SQL injection implementation

Related Questions