How can the issue of SQL injection be addressed when transferring form data to a MySQL database in PHP?

SQL injection can be addressed by using prepared statements with parameterized queries in PHP when transferring form data to a MySQL database. This helps to prevent malicious SQL code from being injected into the query, as the parameters are treated as data rather than executable code. 

// Establish a connection to the database
$mysqli = new mysqli("localhost", "username", "password", "database");

// Prepare a SQL statement with a parameterized query
$stmt = $mysqli->prepare("INSERT INTO table_name (column1, column2) VALUES (?, ?)");

// Bind the form data to the parameters
$stmt->bind_param("ss", $form_data1, $form_data2);

// Set the form data variables
$form_data1 = $_POST['form_field1'];
$form_data2 = $_POST['form_field2'];

// Execute the query
$stmt->execute();

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

SQL injection form data MySQL database PHP security

Related Questions