How can SQL injection vulnerabilities be prevented when updating user data in PHP?

SQL injection vulnerabilities can be prevented when updating user data in PHP by using prepared statements with parameterized queries. This technique ensures that user input is treated as data and not executable SQL code, thus preventing malicious SQL injection attacks. 

// Establish a database connection
$connection = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with placeholders for user input
$statement = $connection->prepare("UPDATE users SET name = :name WHERE id = :id");

// Bind the parameters with user input values
$statement->bindParam(':name', $_POST['name']);
$statement->bindParam(':id', $_POST['id']);

// Execute the statement
$statement->execute();

Keywords

SQL injection PHP prepared statements parameterized queries data validation

Related Questions