How can you prevent SQL injection attacks when handling user input in PHP scripts?

SQL injection attacks can be prevented by using prepared statements and parameterized queries in PHP scripts. This approach ensures that user input is treated as data rather than executable SQL code, thus preventing malicious SQL injection attacks. 

// Establish a connection to the database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement using placeholders
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the user input to the prepared statement
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection user input validation prepared statements PDO mysqli_prepare

Related Questions