What are some best practices for storing user input data in a database using PHP?

When storing user input data in a database using PHP, it is important to sanitize the input to prevent SQL injection attacks. One way to do this is by using prepared statements with parameterized queries. Additionally, it is recommended to validate the input data before storing it in the database to ensure data integrity. 

// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Sanitize and validate user input
$user_input = $_POST['user_input'];
$user_input = mysqli_real_escape_string($conn, $user_input);

// Prepare and execute a parameterized query
$stmt = $conn->prepare("INSERT INTO table_name (column_name) VALUES (?)");
$stmt->bind_param("s", $user_input);

if ($stmt->execute()) {
    echo "Data stored successfully";
} else {
    echo "Error storing data: " . $conn->error;
}

// Close the connection
$stmt->close();
$conn->close();

Keywords

SQL injection PDO prepared statements data validation encryption

Related Questions