What are some best practices for handling user input in PHP when interacting with a database?

When handling user input in PHP for interacting with a database, it is important to sanitize and validate the input to prevent SQL injection attacks and ensure data integrity. One common practice is to use prepared statements with parameterized queries to safely execute SQL commands with user input. 

// Establish database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Sanitize and validate user input
$user_input = $_POST['user_input'];
$user_input = $conn->real_escape_string($user_input);

// Prepare and execute SQL statement with user input
$stmt = $conn->prepare("INSERT INTO table_name (column_name) VALUES (?)");
$stmt->bind_param("s", $user_input);
$stmt->execute();

// Close connection
$stmt->close();
$conn->close();

Keywords

SQL injection prepared statements input validation data sanitization PDO

Related Questions