How can the issue of SQL injection be addressed in PHP code when interacting with a database?

SQL injection can be addressed in PHP code by using prepared statements with parameterized queries. This approach separates SQL logic from user input, preventing malicious SQL code from being executed. By binding parameters to placeholders in the SQL query, the database engine can distinguish between code and data, effectively preventing SQL injection attacks. 

// Establish a connection to the database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL query with a placeholder for user input
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the placeholder
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PHP code database interaction prepared statements parameterized queries

Related Questions