How can SQL-Injection and XSS attacks be prevented when using user input in PHP?

SQL-Injection attacks can be prevented by using prepared statements and parameterized queries in PHP. XSS attacks can be prevented by sanitizing and validating user input before displaying it on a webpage. 

// SQL-Injection prevention using prepared statements
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$stmt->bindParam(':username', $username);
$stmt->execute();

// XSS prevention by sanitizing user input
$username = htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8');
echo $username;

Keywords

SQL-Injection XSS attacks prevention user input PHP

Related Questions