How can SQL injection be prevented in the code?

SQL injection can be prevented by using parameterized queries or prepared statements in your code. This helps to separate SQL code from user input and prevents malicious SQL queries from being executed. 

// Using parameterized queries to prevent SQL injection
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->execute(['username' => $username, 'password' => $password]);
$user = $stmt->fetch();

Keywords

SQL injection prepared statements parameterized queries PDO mysqli_real_escape_string

Related Questions