How can prepared statements and PDO be utilized to enhance security and efficiency in PHP code when interacting with a MySQL database?

Using prepared statements with PDO in PHP can enhance security by preventing SQL injection attacks and improve efficiency by reusing query execution plans. Prepared statements separate SQL logic from user input, allowing the database to distinguish between code and data, thereby preventing malicious SQL injection. This approach also allows the database to optimize the query execution plan and cache it for future use, reducing the overhead of parsing and planning queries repeatedly.

// Establish a connection to the MySQL database using PDO
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Create a prepared statement with a placeholder for user input
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the prepared statement
$stmt->bindParam(':username', $username);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();