How can PHP developers prevent SQL injection attacks when retrieving data from databases using user input?

To prevent SQL injection attacks when retrieving data from databases using user input, PHP developers can use prepared statements with parameterized queries. This method ensures that user input is treated as data and not as SQL code, thus preventing malicious SQL injection attacks. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Use the retrieved data as needed
foreach($results as $row) {
    echo $row['username'] . "<br>";
}

Keywords

Prepared Statements PDO mysqli_real_escape_string SQL Injection Data Sanitization

Related Questions