How can SQL-Injection vulnerabilities be addressed in PHP code when interacting with databases like MySQL?

SQL-Injection vulnerabilities can be addressed in PHP code by using prepared statements with parameterized queries. This method allows the database to distinguish between the SQL code and the data being passed in, preventing malicious SQL injection attacks. 

// Establish a connection to the database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL query with a placeholder for the user input
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL-Injection PHP code MySQL database Prepared Statements Parameterized Queries

Related Questions