How can SQL injection vulnerabilities be prevented in PHP scripts that interact with a database?

SQL injection vulnerabilities can be prevented in PHP scripts by using prepared statements with parameterized queries. This method ensures that user input is treated as data rather than executable code, making it impossible for attackers to inject malicious SQL commands into the query. 

<?php
// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL query with a parameterized statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();
?>

Keywords

SQL injection PHP scripts database interaction prepared statements parameterized queries

Related Questions