What are common pitfalls to avoid when generating URLs from database queries in PHP?

One common pitfall to avoid when generating URLs from database queries in PHP is not properly sanitizing input data, which can lead to SQL injection attacks. To prevent this, always use prepared statements when querying the database and sanitize any user input before using it in a URL. 

// Example of using prepared statements and sanitizing input data when generating URLs from database queries

// Assuming $db is your database connection

// Sanitize user input
$user_input = filter_input(INPUT_GET, 'user_input', FILTER_SANITIZE_STRING);

// Prepare a statement
$stmt = $db->prepare("SELECT * FROM table WHERE column = ?");
$stmt->bind_param("s", $user_input);
$stmt->execute();

// Fetch results
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // Generate URL using data from database query
    $url = 'https://example.com/' . urlencode($row['column']);
    echo '<a href="' . $url . '">' . $row['column'] . '</a><br>';
}

// Close statement and database connection
$stmt->close();
$db->close();

Keywords

SQL injection URL encoding htmlspecialchars query parameters prepared statements

Related Questions