How can PHP prevent SQL injection when handling form data?

SQL injection can be prevented in PHP by using prepared statements with parameterized queries. This method separates the SQL query logic from the user input, preventing malicious SQL code from being executed. By binding parameters to the query, the database treats them as data rather than executable code. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

PHP SQL injection prepared statements PDO mysqli

Related Questions