How can SQL injection be prevented in PHP login scripts?

SQL injection can be prevented in PHP login scripts by using prepared statements with parameterized queries. This helps to sanitize user input and prevent malicious SQL queries from being executed. By using prepared statements, the SQL engine can distinguish between the actual SQL code and the user input, reducing the risk of SQL injection attacks. 

// Using prepared statements to prevent SQL injection in PHP login scripts

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders for user input
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');

// Bind the user input to the placeholders
$stmt->bindParam(':username', $_POST['username']);
$stmt->bindParam(':password', $_POST['password']);

// Execute the query
$stmt->execute();

// Check if the user exists and password matches
$user = $stmt->fetch();
if ($user) {
    // User authenticated, proceed with login
} else {
    // Invalid credentials
}

Keywords

SQL injection PHP prepared statements PDO security

Related Questions