How can user inputs be filtered and validated to prevent SQL injection attacks when querying the database for login information in PHP?

To prevent SQL injection attacks when querying the database for login information in PHP, user inputs should be filtered and validated before being used in SQL queries. This can be done by using prepared statements and parameterized queries to ensure that user inputs are treated as data rather than executable SQL code. 

// Assuming $username and $password are user inputs

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// Prepare a SQL query using a prepared statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');

// Bind the user inputs to the prepared statement parameters
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);

// Execute the query
$stmt->execute();

// Fetch the result
$user = $stmt->fetch();

// Check if a user was found
if($user){
    // User found, proceed with login
} else {
    // User not found, handle error
}

Keywords

SQL injection user input validation database querying PHP functions security measures

Related Questions