What are best practices for handling user actions like delete or update in PHP scripts to avoid security vulnerabilities?

When handling user actions like delete or update in PHP scripts, it is important to sanitize and validate user input to prevent SQL injection attacks and other security vulnerabilities. One way to achieve this is by using prepared statements with parameterized queries to safely execute SQL commands. 

// Connect to the database
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Sanitize and validate user input
$id = filter_var($_POST['id'], FILTER_SANITIZE_NUMBER_INT);
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);

// Prepare a SQL statement using a parameterized query
$stmt = $pdo->prepare("UPDATE users SET name = :name WHERE id = :id");
$stmt->bindParam(':name', $name, PDO::PARAM_STR);
$stmt->bindParam(':id', $id, PDO::PARAM_INT);

// Execute the prepared statement
$stmt->execute();

Keywords

SQL injection Cross-site scripting Prepared statements Input validation CSRF protection

Related Questions