How can SQL injection be prevented when updating user information in PHP?

SQL injection can be prevented when updating user information in PHP by using prepared statements with parameterized queries. This approach separates the SQL query logic from the user input, making it impossible for malicious input to interfere with the query execution. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare("UPDATE users SET email = :email WHERE id = :id");

// Bind the parameters
$stmt->bindParam(':email', $newEmail);
$stmt->bindParam(':id', $userId);

// Execute the statement
$stmt->execute();

Keywords

SQL injection PHP prepared statements parameterized queries input validation

Related Questions