What are some common methods for making SQL statements maintainable in PHP code?

One common method for making SQL statements maintainable in PHP code is to use prepared statements with parameterized queries. This helps prevent SQL injection attacks and makes it easier to read and modify the SQL code. Another approach is to separate the SQL queries into a separate file or class to keep the code organized and easier to maintain. 

// Using prepared statements with parameterized queries
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->execute();
$result = $stmt->fetch();

// Separating SQL queries into a separate file or class
class UserQueries {
    public function getUserById($id) {
        $stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
        $stmt->bindParam(':id', $id, PDO::PARAM_INT);
        $stmt->execute();
        return $stmt->fetch();
    }
}

// Usage
$userQueries = new UserQueries();
$user = $userQueries->getUserById($id);

Keywords

SQL injection prepared statements PDO ORM query builder

Related Questions