How can SQL injection vulnerabilities be avoided when processing user input in PHP scripts, especially when interacting with databases?

SQL injection vulnerabilities can be avoided by using prepared statements with parameterized queries when interacting with databases in PHP scripts. This approach ensures that user input is treated as data rather than executable SQL code, preventing malicious SQL injection attacks. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Use the results as needed
foreach ($results as $row) {
    echo $row['username'] . '<br>';
}

Keywords

SQL injection user input validation prepared statements parameterized queries PDO.

Related Questions