How can prepared statements be used in PHP to prevent SQL injection vulnerabilities?

Prepared statements in PHP can prevent SQL injection vulnerabilities by separating SQL code from user input. This means that user input is treated as data rather than executable SQL code, making it impossible for an attacker to inject malicious SQL queries. Prepared statements achieve this by sending the SQL query to the database separately from the user input, ensuring that the input is always treated as data. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a placeholder for user input
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

prepared statements SQL injection PHP security vulnerabilities

Related Questions