How can PHP developers protect against SQL Injections in their scripts?

SQL Injections occur when user input is not properly sanitized, allowing malicious SQL queries to be executed. PHP developers can protect against SQL Injections by using prepared statements and parameterized queries to separate SQL code from user input. 

// Using prepared statements to protect against SQL Injections
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Using prepared statements to protect against SQL Injections
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

$username = $_POST['username']; // User input

$stmt->execute();
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    // Do something with the data
}

$stmt->close();
$conn->close();

Keywords

SQL Injection PHP Prepared Statements PDO Security

Related Questions