How can SQL injection vulnerabilities be prevented when using user input in SQL queries?

SQL injection vulnerabilities can be prevented by using prepared statements or parameterized queries when incorporating user input into SQL queries. This helps to separate the SQL logic from the user input, preventing malicious SQL code from being executed. 

// Example of using prepared statements to prevent SQL injection

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL query with a placeholder for user input
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Use the results as needed
foreach ($results as $row) {
    echo $row['username'] . "<br>";
}

Keywords

SQL injection prepared statements parameterized queries PDO mysqli_real_escape_string

Related Questions