What are some best practices for sanitizing user input in PHP before storing it in a MySQL database?

When storing user input in a MySQL database, it is important to sanitize the input to prevent SQL injection attacks. One way to do this is by using prepared statements with parameterized queries in PHP. This method separates the SQL query from the user input, making it impossible for malicious input to interfere with the query execution. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Sanitize user input
$userInput = $_POST['user_input'];
$stmt = $pdo->prepare("INSERT INTO table_name (column_name) VALUES (:user_input)");
$stmt->bindParam(':user_input', $userInput);
$stmt->execute();

Keywords

SQL injection htmlspecialchars prepared statements filter_input data validation

Related Questions