How does the use of prepare and execute in this code affect the mysql_* functions?

Using prepare and execute in the code helps prevent SQL injection attacks by properly escaping input data. This ensures that user input is treated as data rather than executable SQL code. By using prepared statements, the MySQL functions are able to separate the data from the query structure, making it more secure. 

// Fix using prepare and execute
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare a statement
$stmt = $conn->prepare("INSERT INTO users (username, password) VALUES (?, ?)");

// Bind parameters and execute the statement
$stmt->bind_param("ss", $username, $password);

// Set parameters and execute
$username = "john_doe";
$password = "password123";
$stmt->execute();

echo "New record created successfully";

$stmt->close();
$conn->close();

Keywords

prepare execute mysql_ functions SQL injection security

Related Questions