How can PHP developers prevent SQL injection attacks when updating user profile information in a database?

To prevent SQL injection attacks when updating user profile information in a database, PHP developers should use prepared statements with parameterized queries. This approach allows developers to separate SQL code from user input, preventing malicious SQL injection attempts. 

// Connect to the database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare the SQL statement with placeholders
$stmt = $pdo->prepare("UPDATE users SET username = :username, email = :email WHERE id = :id");

// Bind parameters to the placeholders
$stmt->bindParam(':username', $newUsername);
$stmt->bindParam(':email', $newEmail);
$stmt->bindParam(':id', $userId);

// Execute the prepared statement
$stmt->execute();

Keywords

SQL injection PHP prepared statements parameterized queries database security

Related Questions