What are common pitfalls when querying data from MySQL in PHP?

One common pitfall when querying data from MySQL in PHP is not properly sanitizing user input, which can lead to SQL injection attacks. To prevent this, always use prepared statements with parameterized queries to securely pass user input to the database. 

// Connect to MySQL database
$mysqli = new mysqli("localhost", "username", "password", "database");

// Prepare a statement with a parameterized query
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set the parameter and execute the query
$username = $_POST['username'];
$stmt->execute();

// Fetch the results
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // Process the fetched data
}

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

MySQL PHP SQL injection PDO error handling

Related Questions