How can SQL injection vulnerabilities be prevented in PHP authentication scripts?

SQL injection vulnerabilities in PHP authentication scripts can be prevented by using prepared statements with parameterized queries. This method ensures that user input is treated as data rather than executable SQL code, effectively preventing malicious SQL injection attacks. 

// Using prepared statements with parameterized queries to prevent SQL injection

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');

// Bind parameters to the placeholders
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);

// Execute the query
$stmt->execute();

// Fetch the results
$user = $stmt->fetch();

Keywords

SQL injection PHP authentication prepared statements parameterized queries input validation

Related Questions