How can the vulnerability to SQL injection in PHP code be mitigated, especially when dealing with user input for database queries?

To mitigate the vulnerability to SQL injection in PHP code, especially when dealing with user input for database queries, you should use prepared statements with parameterized queries. This approach separates the SQL query logic from the user input data, preventing malicious SQL code from being injected into the query. 

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the prepared statement
$stmt->bindParam(':username', $_POST['username']);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Use the results as needed
foreach ($results as $row) {
    echo $row['username'] . "<br>";
}

Keywords

SQL injection PHP code user input database queries vulnerability

Related Questions