How can SQL injections be prevented in PHP scripts when querying a database?

SQL injections can be prevented in PHP scripts by using prepared statements with parameterized queries. This method ensures that user input is treated as data rather than executable SQL code, thus preventing malicious SQL injections. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');

// Bind parameters to the placeholders
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection prepared statements PDO mysqli_real_escape_string parameterized queries

Related Questions