How can SQL injection vulnerabilities be prevented when querying a database in PHP?

SQL injection vulnerabilities can be prevented in PHP by using prepared statements with parameterized queries. This method separates the SQL query from the user input, preventing malicious SQL code from being injected into the query. 

// Connect to the database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a placeholder for user input
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

Keywords

SQL injection database querying prepared statements parameterized queries PDO

Related Questions