How can SQL Injections be prevented in PHP code like the one shown in the forum thread?

SQL Injections can be prevented in PHP code by using prepared statements with parameterized queries. This approach ensures that user input is treated as data rather than executable code, thus preventing malicious SQL injection attacks. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL Injection PHP code Prepared Statements PDO Security

Related Questions