What are some best practices for handling database queries and results in PHP?

When handling database queries and results in PHP, it is essential to use parameterized queries to prevent SQL injection attacks. Additionally, always check for errors after executing a query and handle them appropriately. It's also a good practice to fetch results in a safe and efficient manner, such as using prepared statements. 

// Example of handling database query with parameterized query and error handling

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// Prepare a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');

// Bind parameters
$stmt->bindParam(':id', $id, PDO::PARAM_INT);

// Execute the query
$stmt->execute();

// Check for errors
if($stmt->errorCode() !== '00000'){
    // Handle error
    $errorInfo = $stmt->errorInfo();
    echo 'Error: ' . $errorInfo[2];
} else {
    // Fetch results
    $user = $stmt->fetch(PDO::FETCH_ASSOC);
    
    // Process the results
    if($user){
        // Do something with the user data
    } else {
        // Handle no results found
    }
}

Keywords

SQL injection PDO prepared statements error handling data validation

Related Questions