How can PHP developers ensure that data values are properly enclosed in quotes when inserting into a database?

To ensure that data values are properly enclosed in quotes when inserting into a database, PHP developers can use prepared statements with parameterized queries. This approach separates the SQL query from the data values, preventing SQL injection attacks and automatically handling the proper quoting of values. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with placeholders for data values
$stmt = $pdo->prepare("INSERT INTO mytable (column1, column2) VALUES (:value1, :value2)");

// Bind the data values to the placeholders
$stmt->bindParam(':value1', $value1);
$stmt->bindParam(':value2', $value2);

// Execute the statement with the bound values
$value1 = "John Doe";
$value2 = 25;
$stmt->execute();

Keywords

PHP database SQL injection prepared statements data sanitization

Related Questions