What are common pitfalls when accessing query results in PHP?

Common pitfalls when accessing query results in PHP include not checking if the query was successful before trying to access the results, not handling errors properly, and not properly escaping or sanitizing user input to prevent SQL injection attacks. To solve these issues, always check if the query was successful, handle errors with try-catch blocks, and use prepared statements or parameterized queries to prevent SQL injection. 

// Check if the query was successful before accessing results
$result = $connection->query("SELECT * FROM table");
if ($result) {
    // Access results here
} else {
    echo "Error executing query: " . $connection->error;
}

// Handle errors with try-catch blocks
try {
    $result = $connection->query("SELECT * FROM table");
    // Access results here
} catch (Exception $e) {
    echo "Error executing query: " . $e->getMessage();
}

// Use prepared statements to prevent SQL injection
$stmt = $connection->prepare("SELECT * FROM table WHERE id = ?");
$stmt->bind_param("i", $id);
$id = 1;
$stmt->execute();
$result = $stmt->get_result();
// Access results here

Keywords

SQL injection PDO mysqli error handling data validation

Related Questions