How can SQL injection vulnerabilities be prevented in PHP code that interacts with a MySQL database?

SQL injection vulnerabilities can be prevented in PHP code by using prepared statements with parameterized queries. This approach ensures that user input is treated as data rather than executable SQL code, making it impossible for attackers to inject malicious SQL statements. 

// Establish a connection to the MySQL database
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders for user input
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the placeholders
$stmt->bindParam(':username', $_POST['username']);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP MySQL prepared statements parameterized queries

Related Questions