How can user input from GET variables be securely handled to prevent vulnerabilities such as SQL injection in PHP?

To prevent vulnerabilities like SQL injection when handling user input from GET variables in PHP, you should always sanitize and validate the input before using it in database queries. One way to do this is by using prepared statements with parameterized queries, which help prevent malicious SQL injection attacks by separating SQL code from user input. 

// Example of securely handling user input from GET variables to prevent SQL injection
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check if the 'id' parameter is set in the GET request
if(isset($_GET['id'])) {
    // Sanitize the input
    $id = $mysqli->real_escape_string($_GET['id']);
    
    // Prepare a SQL statement using a parameterized query
    $stmt = $mysqli->prepare("SELECT * FROM users WHERE id = ?");
    
    // Bind the parameter to the statement
    $stmt->bind_param("i", $id);
    
    // Execute the statement
    $stmt->execute();
    
    // Get the result
    $result = $stmt->get_result();
    
    // Fetch the data
    while($row = $result->fetch_assoc()) {
        // Output the data
        echo $row['username'];
    }
    
    // Close the statement
    $stmt->close();
}

// Close the database connection
$mysqli->close();

Keywords

GET variables user input SQL injection security PHP

Related Questions