What are some best practices for accessing a MySQL database using PHP?

When accessing a MySQL database using PHP, it is important to follow best practices to ensure security and efficiency. One common practice is to use prepared statements to prevent SQL injection attacks. Additionally, it is recommended to establish a secure connection to the database using PDO or MySQLi extensions. Finally, always remember to sanitize user input before executing queries to prevent any malicious code from being executed. 

// Establish a connection to the MySQL database using PDO
$host = 'localhost';
$dbname = 'database_name';
$username = 'username';
$password = 'password';

try {
    $conn = new PDO("mysql:host=$host;dbname=$dbname", $username, $password);
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e) {
    echo "Connection failed: " . $e->getMessage();
}

// Example of using prepared statements to query the database
$stmt = $conn->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username);
$stmt->execute();
$result = $stmt->fetchAll();

// Sanitize user input before executing queries
$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);
$password = filter_var($_POST['password'], FILTER_SANITIZE_STRING);

Keywords

MySQL PHP database connection SQL injection PDO

Related Questions