How can SQL injections be prevented in PHP code, especially when inserting data into a database?

SQL injections can be prevented in PHP code by using prepared statements with parameterized queries. This approach separates the SQL query from the user input, preventing malicious SQL code from being injected into the query. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");

// Bind the parameters
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);

// Execute the statement
$stmt->execute();

Keywords

SQL injections PHP code data insertion database security prepared statements

Related Questions