What are common best practices for accessing and manipulating data from a database in PHP?

When accessing and manipulating data from a database in PHP, it is important to use prepared statements to prevent SQL injection attacks and ensure data integrity. Additionally, it is recommended to establish a secure database connection using PDO or mysqli extension. Finally, always remember to sanitize user input before executing any database queries. 

// Establish a database connection using PDO
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

try {
    $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
    echo "Connection failed: " . $e->getMessage();
}

// Using prepared statements to prevent SQL injection
$stmt = $conn->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username);
$stmt->execute();
$result = $stmt->fetch(PDO::FETCH_ASSOC);

// Sanitize user input
$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);

Keywords

SQL injection PDO prepared statements MySQLi data sanitization

Related Questions