How can PHP developers prevent SQL injection attacks when using dynamic queries like in the provided code snippet?

SQL injection attacks can be prevented by using prepared statements with parameterized queries instead of directly interpolating user input into the SQL query. This approach ensures that the user input is treated as data rather than executable SQL code, effectively preventing malicious SQL injection attempts. 

// Using prepared statements to prevent SQL injection

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// User input (potentially vulnerable to SQL injection)
$user_input = $_GET['user_input'];

// Prepare a SQL statement with a placeholder for the user input
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the placeholder
$stmt->bindParam(':username', $user_input);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

// Process the results as needed
foreach ($results as $row) {
    // Do something with the data
}

Keywords

SQL injection dynamic queries prepared statements PDO security

Related Questions