How can SQL injection vulnerabilities be avoided when writing PHP code for database queries?

SQL injection vulnerabilities can be avoided in PHP code by using prepared statements with parameterized queries. This approach separates the SQL query from the user input, preventing malicious input from being executed as SQL commands. Example PHP code snippet using prepared statements: 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL query with a placeholder for user input
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP code database queries prepared statements parameterized queries

Related Questions