How can the code be improved to prevent SQL injection vulnerabilities?

SQL injection vulnerabilities can be prevented by using prepared statements with parameterized queries. This approach ensures that user input is treated as data rather than executable SQL code, effectively preventing malicious SQL injection attacks. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');

// Prepare a SQL statement with placeholders
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind parameters to placeholders
$stmt->bindParam(':username', $_POST['username']);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

Prepared Statements PDO mysqli_real_escape_string SQL Injection Security

Related Questions