In PHP, what are the common pitfalls to avoid when displaying multiple user-specific data entries from a database in separate fields?

When displaying multiple user-specific data entries from a database in separate fields, a common pitfall to avoid is not properly sanitizing user input to prevent SQL injection attacks. To solve this issue, always use prepared statements with parameterized queries to securely retrieve and display data from the database. 

<?php
// Assuming $userId is the user ID of the current user
$userId = $_SESSION['user_id'];

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare("SELECT field1, field2, field3 FROM user_data WHERE user_id = :user_id");
$stmt->bindParam(':user_id', $userId, PDO::PARAM_INT);
$stmt->execute();

// Fetch and display the user-specific data entries in separate fields
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
    echo "Field 1: " . htmlspecialchars($row['field1']) . "<br>";
    echo "Field 2: " . htmlspecialchars($row['field2']) . "<br>";
    echo "Field 3: " . htmlspecialchars($row['field3']) . "<br>";
}
?>

Keywords

SQL injection data validation prepared statements XSS attacks database normalization

Related Questions