How can PHP developers prevent SQL injection vulnerabilities in their code?

To prevent SQL injection vulnerabilities in PHP code, developers should use prepared statements with parameterized queries instead of directly concatenating user input into SQL queries. This approach ensures that user input is treated as data rather than executable SQL code, thereby preventing malicious SQL injection attacks.

// Using prepared statements to prevent SQL injection
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();