How can SQL injection vulnerabilities be mitigated when using user input in PHP queries?

SQL injection vulnerabilities can be mitigated by using prepared statements with parameterized queries in PHP. This approach separates the SQL query logic from the user input data, preventing malicious SQL commands from being executed. By binding parameters to placeholders in the query, the database engine can distinguish between SQL code and user input, making it safe to use user input in queries. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP queries user input prepared statements parameterized queries

Related Questions