What are common pitfalls when using PHP for form submissions, such as contact forms?

One common pitfall when using PHP for form submissions is not properly sanitizing user input, which can leave your application vulnerable to SQL injection attacks. To solve this issue, always sanitize and validate user input before using it in your database queries. 

// Sanitize and validate user input
$name = htmlspecialchars($_POST['name']);
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
$message = htmlspecialchars($_POST['message']);

// Use prepared statements to prevent SQL injection
$stmt = $pdo->prepare("INSERT INTO contact_form (name, email, message) VALUES (:name, :email, :message)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':email', $email);
$stmt->bindParam(':message', $message);
$stmt->execute();

Keywords

SQL injection cross-site scripting (XSS) form validation CSRF protection PHPMailer

Related Questions