How can SQL injection be prevented in PHP code?

SQL injection can be prevented in PHP code by using prepared statements with parameterized queries. This approach separates SQL code from user input, preventing malicious SQL commands from being executed. By binding parameters to placeholders in the SQL query, the database engine can distinguish between code and data, effectively thwarting SQL injection attacks. 

// Establish a connection to the database
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');

// Prepare a SQL query with placeholders
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind parameters to placeholders
$stmt->bindParam(':username', $username);

// Execute the query
$stmt->execute();

// Fetch results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP code prepared statements parameterized queries input validation

Related Questions