How can SQL injection vulnerabilities be addressed in the PHP script that retrieves news entries from a database?

SQL injection vulnerabilities can be addressed in a PHP script by using prepared statements with parameterized queries. This helps to separate SQL code from user input, preventing malicious SQL injection attacks. By binding parameters to placeholders in the query, the database engine can distinguish between code and data, effectively neutralizing the threat. 

// Connect to the database
$pdo = new PDO('mysql:host=localhost;dbname=news_db', 'username', 'password');

// Prepare a statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM news WHERE id = :id');

// Bind the parameter value to the placeholder
$stmt->bindParam(':id', $_GET['id'], PDO::PARAM_INT);

// Execute the query
$stmt->execute();

// Fetch the result
$newsEntry = $stmt->fetch();

Keywords

SQL injection PHP script database retrieval security measures prepared statements

Related Questions