How can SQL injection vulnerabilities be prevented when inserting data into a MySQL database using PHP?

SQL injection vulnerabilities can be prevented by using prepared statements with parameterized queries in PHP when inserting data into a MySQL database. This method ensures that user input is treated as data and not executable SQL code, thus protecting against malicious SQL injection attacks. 

// Establish a connection to the MySQL database
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// Prepare a SQL statement using a parameterized query
$stmt = $pdo->prepare("INSERT INTO table_name (column1, column2) VALUES (:value1, :value2)");

// Bind parameters to the query
$stmt->bindParam(':value1', $value1);
$stmt->bindParam(':value2', $value2);

// Execute the query with the sanitized parameters
$value1 = $_POST['input1'];
$value2 = $_POST['input2'];
$stmt->execute();

Keywords

SQL injection MySQL database PHP prepared statements parameterized queries

Related Questions