How can PHP code be structured to prevent SQL injection vulnerabilities?

To prevent SQL injection vulnerabilities in PHP code, developers should use prepared statements with parameterized queries instead of directly inserting user input into SQL queries. This approach separates the SQL logic from the user input, making it impossible for malicious input to alter the query structure. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a placeholder for user input
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP code structured prevent vulnerabilities

Related Questions