How can prepared statements help prevent SQL injection in PHP applications?

Prepared statements in PHP help prevent SQL injection by separating SQL code from user input. This means that user input is treated as data rather than executable code, making it impossible for an attacker to inject malicious SQL commands into the query. 

// Example code snippet using prepared statements to prevent SQL injection

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL query with a placeholder for user input
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Use the results as needed
foreach ($results as $row) {
    echo $row['username'] . "<br>";
}

Keywords

Prepared statements SQL injection PHP applications security data sanitization

Related Questions