What are some common mistakes to avoid when using PHP to populate a dropdown menu with database data?

One common mistake to avoid when populating a dropdown menu with database data in PHP is not properly sanitizing the input data, which can lead to SQL injection attacks. To solve this issue, use prepared statements to safely query the database and retrieve the data for the dropdown menu. 

// Connect to the database
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// Prepare the SQL query
$stmt = $pdo->prepare("SELECT id, name FROM options_table");

// Execute the query
$stmt->execute();

// Populate the dropdown menu with data
echo '<select name="options">';
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
    echo '<option value="' . $row['id'] . '">' . $row['name'] . '</option>';
}
echo '</select>';

Keywords

SQL injection mysqli_real_escape_string prepared statements XSS attacks data validation

Related Questions