How can SQL injection vulnerabilities be prevented when using $_GET variables in SQL queries in PHP?

SQL injection vulnerabilities can be prevented by using prepared statements with parameterized queries when using $_GET variables in SQL queries in PHP. This helps to sanitize the input data and prevent malicious SQL code from being executed. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a placeholder for the parameter
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");

// Bind the parameter value to the placeholder
$stmt->bindParam(':id', $_GET['id']);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection $_GET variables SQL queries prepared statements parameterized queries

Related Questions