How can PHP be utilized to securely handle data input from user-generated forms in a database?

When handling user input from forms in a database, it is essential to sanitize and validate the data to prevent SQL injection attacks and other security vulnerabilities. PHP provides functions like mysqli_real_escape_string() and filter_var() to sanitize and validate user input before inserting it into the database. 

// Assuming $conn is your database connection

// Sanitize user input
$name = mysqli_real_escape_string($conn, $_POST['name']);
$email = mysqli_real_escape_string($conn, $_POST['email']);

// Validate user input
if(filter_var($email, FILTER_VALIDATE_EMAIL)) {
    // Insert sanitized data into the database
    $query = "INSERT INTO users (name, email) VALUES ('$name', '$email')";
    mysqli_query($conn, $query);
} else {
    echo "Invalid email address";
}

Keywords

PHP data input user-generated forms database security

Related Questions