How can PHP developers prevent SQL injection attacks in their code?

SQL injection attacks can be prevented in PHP code by using prepared statements with parameterized queries. This approach separates the SQL query from the user input, preventing malicious SQL code from being injected into the query. By binding parameters to the query, the database engine can distinguish between SQL code and data, effectively protecting against SQL injection attacks. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind parameters to the placeholders
$stmt->bindParam(':username', $_POST['username']);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP prepared statements PDO security

Related Questions