How can variables be properly sanitized before being used in SQL queries to prevent SQL injection attacks?

To prevent SQL injection attacks, variables should be properly sanitized before being used in SQL queries. This can be done by using prepared statements or parameterized queries, which separate the SQL code from the data input. This ensures that the input is treated as data and not as part of the SQL query, effectively preventing malicious SQL injection. 

// Example of using prepared statements to sanitize variables in SQL queries
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a SQL query using a prepared statement
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Sanitize the input variable
$username = mysqli_real_escape_string($mysqli, $_POST['username']);

// Execute the prepared statement
$stmt->execute();

// Fetch the results
$result = $stmt->get_result();

// Process the results
while ($row = $result->fetch_assoc()) {
    // Do something with the data
}

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

PHP SQL injection sanitization prepared statements mysqli_real_escape_string

Related Questions