In the provided PHP script, how can SQL injections be prevented when accessing user input from $_POST["ST_NUMMER"]?

To prevent SQL injections when accessing user input from $_POST["ST_NUMMER"], you should use prepared statements with parameterized queries. This method separates SQL code from user input, making it impossible for malicious SQL code to be injected. By binding parameters to the query, the database treats them as data rather than executable code. 

<?php
// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare a SQL statement with a parameterized query
$stmt = $conn->prepare("SELECT * FROM users WHERE ST_NUMMER = ?");
$stmt->bind_param("s", $_POST["ST_NUMMER"]);

// Execute the prepared statement
$stmt->execute();

// Process the results
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // Process each row
}

// Close the statement and connection
$stmt->close();
$conn->close();
?>

Keywords

SQL injection $_POST prepared statements mysqli_real_escape_string security

Related Questions