How can PHP variables be properly used in SQL update statements?

When using PHP variables in SQL update statements, it is important to properly sanitize the input to prevent SQL injection attacks. One way to do this is by using prepared statements with placeholders for the variables, and then binding the PHP variables to the placeholders before executing the query. 

// Assume $conn is the database connection

// Sanitize the input variables
$id = mysqli_real_escape_string($conn, $id);
$newValue = mysqli_real_escape_string($conn, $newValue);

// Prepare the update statement with placeholders
$stmt = $conn->prepare("UPDATE table_name SET column_name = ? WHERE id = ?");

// Bind the PHP variables to the placeholders
$stmt->bind_param("si", $newValue, $id);

// Execute the query
$stmt->execute();

Keywords

PHP SQL variables update statements security

Related Questions