How can you ensure that the ID parameter is properly sanitized before using it in a SQL query?

To ensure that the ID parameter is properly sanitized before using it in a SQL query, you can use prepared statements with parameter binding. This method helps prevent SQL injection attacks by separating the SQL query from the user input. 

// Assuming $id is the ID parameter from user input
$id = $_GET['id'];

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a placeholder for the ID parameter
$stmt = $pdo->prepare('SELECT * FROM mytable WHERE id = :id');

// Bind the sanitized ID parameter to the placeholder
$stmt->bindParam(':id', $id, PDO::PARAM_INT);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection prepared statements PDO mysqli_real_escape_string input validation

Related Questions