How can PHP developers ensure data security when outputting SQL query results directly into HTML tables?

To ensure data security when outputting SQL query results directly into HTML tables, PHP developers should use prepared statements to prevent SQL injection attacks. By binding parameters to placeholders in the SQL query, developers can ensure that user input is treated as data rather than executable code. 

<?php
// Establish database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare SQL query with placeholders
$stmt = $pdo->prepare("SELECT * FROM mytable WHERE id = :id");

// Bind parameter to placeholder
$stmt->bindParam(':id', $_GET['id']);

// Execute query
$stmt->execute();

// Output results in HTML table
echo "<table>";
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
    echo "<tr>";
    foreach ($row as $key => $value) {
        echo "<td>" . htmlspecialchars($value) . "</td>";
    }
    echo "</tr>";
}
echo "</table>";
?>

Keywords

SQL injection htmlentities prepared statements data validation XSS protection

Related Questions