How can SQL injection vulnerabilities be addressed in PHP scripts that interact with MySQL databases?

SQL injection vulnerabilities can be addressed in PHP scripts by using prepared statements with parameterized queries instead of directly inserting user input into SQL queries. This helps to prevent malicious SQL code from being injected into the query and executed by the database. 

// Establish a connection to the MySQL database
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// Prepare a SQL query with a parameterized statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the parameter in the query
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP scripts MySQL databases security measures prepared statements

Related Questions