How should a select query to a database be handled when the search keyword comes from an input field?

When handling a select query to a database with a search keyword coming from an input field, it is important to sanitize the input to prevent SQL injection attacks. One way to do this is by using prepared statements with parameterized queries in PHP. This approach separates the SQL query from the user input, making it safe to execute. 

// Assuming $searchKeyword contains the keyword from the input field

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=database", "username", "password");

// Prepare a SQL statement with a placeholder for the search keyword
$stmt = $pdo->prepare("SELECT * FROM table WHERE column_name = :keyword");

// Bind the search keyword to the placeholder
$stmt->bindParam(':keyword', $searchKeyword);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Use the results as needed
foreach ($results as $row) {
    // Process each row
}

Keywords

PHP SQL database query input sanitization prepared statements

Related Questions