What are the best practices for securely passing variables in SQL queries in PHP?

When passing variables in SQL queries in PHP, it is important to use prepared statements to prevent SQL injection attacks. Prepared statements separate the SQL query from the user input, ensuring that input is treated as data and not executable code. This practice helps to protect your database from malicious queries. 

// Using prepared statements to securely pass variables in SQL queries
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a placeholder for the variable
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the variable to the placeholder and execute the query
$stmt->bindParam(':username', $username);
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection prepared statements PDO mysqli_real_escape_string parameterized queries

Related Questions