How can SQL injection be prevented in the UPDATE query?

SQL injection in an UPDATE query can be prevented by using prepared statements with parameterized queries. This method ensures that user input is treated as data and not executable code, effectively preventing malicious SQL injection attacks. 

// Assuming $conn is the database connection object

// User input
$userInput = $_POST['user_input'];

// Prepare the SQL statement with a parameterized query
$stmt = $conn->prepare("UPDATE table_name SET column_name = ? WHERE condition = ?");
$stmt->bind_param("ss", $userInput, $condition);

// Execute the prepared statement
$stmt->execute();
$stmt->close();

Keywords

SQL injection UPDATE query prepared statements parameterized queries mysqli_real_escape_string

Related Questions