How can SQL injection vulnerabilities be prevented when updating database records in PHP?

SQL injection vulnerabilities can be prevented when updating database records in PHP by using prepared statements with parameterized queries. This technique ensures that user input is treated as data rather than executable SQL code, thereby preventing malicious SQL injection attacks. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare("UPDATE users SET name = :name WHERE id = :id");

// Bind parameters to the placeholders
$stmt->bindParam(':name', $_POST['name']);
$stmt->bindParam(':id', $_POST['id']);

// Execute the prepared statement
$stmt->execute();

Keywords

SQL injection database records PHP prepared statements parameterized queries

Related Questions