What are some best practices for handling input validation and error reporting in PHP when querying a database?

When querying a database in PHP, it is important to properly validate user input to prevent SQL injection attacks and other security vulnerabilities. Additionally, error reporting should be handled effectively to provide meaningful feedback to the user in case of any issues. 

// Validate user input before using it in a database query
$user_input = $_POST['user_input'];
if (!is_numeric($user_input)) {
    // Handle invalid input error
    echo "Invalid input. Please enter a numeric value.";
    exit;
}

// Connect to the database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Query the database
$sql = "SELECT * FROM table WHERE column = $user_input";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    // Output data
} else {
    // Handle no results error
    echo "No results found.";
}

// Close the connection
$conn->close();

Keywords

SQL injection prepared statements PDO error handling data sanitization

Related Questions