How can prepared statements be effectively used in PHP to prevent SQL injection and improve database performance?

To prevent SQL injection and improve database performance in PHP, prepared statements should be used. Prepared statements separate SQL code from user input, preventing malicious code injection. They also allow the database to optimize query execution by preparing the query once and executing it multiple times with different parameters. 

// Connect to database
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');

// Prepare a SQL statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind parameters
$stmt->bindParam(':username', $_POST['username']);

// Execute the statement
$stmt->execute();

// Fetch results
$results = $stmt->fetchAll();

// Loop through results
foreach ($results as $row) {
    echo $row['username'] . "<br>";
}

Keywords

Prepared statements PHP SQL injection database performance security.

Related Questions