How can PHP developers ensure secure input handling to prevent SQL injection in login forms?

To prevent SQL injection in login forms, PHP developers should use prepared statements with parameterized queries instead of directly inserting user input into SQL queries. This helps to sanitize the input data and prevent malicious SQL code from being executed. 

// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Prepare a SQL statement using a parameterized query
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);

// Set parameters and execute the statement
$username = $_POST['username'];
$password = $_POST['password'];
$stmt->execute();

// Check if the user exists and login if successful
$result = $stmt->get_result();
if($result->num_rows > 0) {
    // User authenticated, proceed with login
} else {
    // Invalid credentials, display error message
}

// Close the statement and database connection
$stmt->close();
$conn->close();

Keywords

PHP secure input handling SQL injection login forms prevention

Related Questions