What are best practices for handling user input in PHP to prevent SQL injection vulnerabilities?

To prevent SQL injection vulnerabilities in PHP, it is important to sanitize and validate user input before using it in database queries. One common approach is to use prepared statements with parameterized queries, which separate SQL code from user input. This helps to prevent malicious SQL code from being injected into the query. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Sanitize and validate user input
$user_input = $_POST['user_input']; // assuming user input is submitted via POST
$user_input = filter_var($user_input, FILTER_SANITIZE_STRING);

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$stmt->bindParam(':username', $user_input);
$stmt->execute();

// Fetch results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Process the results
foreach ($results as $row) {
    // Output or process each row as needed
}

Keywords

SQL injection user input validation prepared statements PDO escaping data

Related Questions