What are best practices for handling form data validation and insertion into a database in PHP?

When handling form data validation and insertion into a database in PHP, it is important to sanitize and validate the input data to prevent SQL injection and other security risks. Use prepared statements to safely insert data into the database. Additionally, make sure to validate the form data on the server-side to ensure data integrity. 

// Validate form data
$name = $_POST['name'];
$email = $_POST['email'];

if(empty($name) || empty($email)){
    echo "Name and email are required fields";
    exit;
}

// Sanitize input data
$name = filter_var($name, FILTER_SANITIZE_STRING);
$email = filter_var($email, FILTER_SANITIZE_EMAIL);

// Insert data into the database using prepared statements
$stmt = $pdo->prepare("INSERT INTO users (name, email) VALUES (:name, :email)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':email', $email);
$stmt->execute();

echo "Data inserted successfully";

Keywords

form data validation database insertion PHP SQL injection error handling

Related Questions