How can SQL injection vulnerabilities be mitigated in PHP code that handles user input, such as GET parameters?

SQL injection vulnerabilities can be mitigated in PHP code by using prepared statements with parameterized queries. This approach separates the SQL query logic from the user input, preventing malicious SQL code from being executed. By binding user input as parameters in the query, the database engine treats them as data values rather than executable code. 

// Example PHP code snippet using prepared statements to mitigate SQL injection vulnerabilities
$mysqli = new mysqli("localhost", "username", "password", "database");

if ($stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ? AND password = ?")) {
    $stmt->bind_param("ss", $_GET['username'], $_GET['password']);
    $stmt->execute();
    
    // Process the results
    $stmt->close();
}

$mysqli->close();

Keywords

SQL injection PHP code user input GET parameters mitigation

Related Questions