How can PHP developers avoid SQL injection when using GET parameters in their queries?

To avoid SQL injection when using GET parameters in queries, PHP developers should use prepared statements with parameterized queries. This approach separates the SQL query logic from the user input, preventing malicious input from being executed as SQL commands. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the GET parameter to the prepared statement
$stmt->bindParam(':username', $_GET['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

// Use the results as needed
foreach ($results as $row) {
    echo $row['username'] . '<br>';
}

Keywords

PHP SQL injection GET parameters prepared statements mysqli_prepare

Related Questions