What are some common pitfalls when writing PHP scripts for online shops, particularly in terms of database queries?

One common pitfall when writing PHP scripts for online shops is not properly sanitizing user input before using it in database queries. This can lead to SQL injection attacks. To prevent this, always use prepared statements or parameterized queries when interacting with the database. 

// Example of using prepared statements to prevent SQL injection
$stmt = $pdo->prepare("SELECT * FROM products WHERE id = :id");
$stmt->bindParam(':id', $productId, PDO::PARAM_INT);
$stmt->execute();
$product = $stmt->fetch();

Keywords

SQL injection PDO prepared statements database normalization indexing

Related Questions