In the context of PHP, what are the differences between binding result sets and escaping variables for database queries?

When dealing with database queries in PHP, binding result sets involves securely retrieving data from the database without the risk of SQL injection attacks. Escaping variables, on the other hand, involves sanitizing user input to prevent malicious code from being executed in the database query. 

// Binding result sets
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username, PDO::PARAM_STR);
$stmt->execute();
$results = $stmt->fetchAll();

// Escaping variables
$username = mysqli_real_escape_string($conn, $_POST['username']);
$password = mysqli_real_escape_string($conn, $_POST['password']);

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

Keywords

PHP binding result sets escaping variables

Related Questions