How can the use of mysqli or PDO prevent SQL injection vulnerabilities in PHP?

Using mysqli or PDO in PHP can prevent SQL injection vulnerabilities by utilizing prepared statements. Prepared statements separate SQL query logic from user input, which prevents malicious SQL code from being injected into the query. This helps to sanitize user input and protect against SQL injection attacks. 

// Using prepared statements with mysqli
$conn = new mysqli($servername, $username, $password, $dbname);

$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

$username = $_POST['username'];
$stmt->execute();
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    // Process the results
}

$stmt->close();
$conn->close();

Keywords

mysqli PDO SQL injection vulnerabilities PHP

Related Questions