How can SQL injection vulnerabilities be avoided when updating database records using PHP?

SQL injection vulnerabilities can be avoided by using prepared statements with parameterized queries in PHP when updating database records. This method separates the SQL query from the user input, preventing malicious SQL code from being executed. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');

// Prepare a SQL query with placeholders for user input
$stmt = $pdo->prepare("UPDATE users SET name = :name WHERE id = :id");

// Bind the user input to the placeholders
$stmt->bindParam(':name', $name);
$stmt->bindParam(':id', $id);

// Execute the query
$stmt->execute();

Keywords

SQL injection database records PHP prepared statements parameterized queries

Related Questions