How can semicolons be properly escaped in SQL queries when using PHP?

When dealing with SQL queries in PHP, semicolons are used as statement terminators. If a semicolon appears within the actual data being inserted or queried, it can cause syntax errors or potentially be used for SQL injection attacks. To properly escape semicolons in SQL queries, you can use prepared statements with parameterized queries in PHP to separate the data from the SQL code, ensuring that semicolons within the data do not interfere with the query execution. 

// Example of using prepared statements to properly escape semicolons in SQL queries
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

$data = "Some data with a semicolon; and more data";

$stmt = $pdo->prepare("INSERT INTO mytable (column_name) VALUES (:data)");
$stmt->bindParam(':data', $data);
$stmt->execute();

Keywords

PHP SQL queries escaping semicolons security

Related Questions