What are the best practices for securely passing and using variables like IDs in SQL queries in PHP?

When passing variables like IDs in SQL queries in PHP, it is important to sanitize and validate the input to prevent SQL injection attacks. One way to do this is by using prepared statements with parameter binding, which separates the SQL query from the user input. This ensures that the input is treated as data rather than executable code. 

// Example of securely passing and using variables like IDs in SQL queries in PHP

// Assuming $id contains the user input ID
$id = $_GET['id'];

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// Prepare a SQL statement with a placeholder for the ID
$stmt = $pdo->prepare('SELECT * FROM table WHERE id = :id');

// Bind the sanitized ID to the placeholder
$stmt->bindParam(':id', $id, PDO::PARAM_INT);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

// Process the results as needed
foreach ($results as $row) {
    // Do something with the data
}

Keywords

SQL injection prepared statements PDO parameterized queries escaping.

Related Questions