What are the best practices for accessing and manipulating data retrieved from a database in PHP?

When accessing and manipulating data retrieved from a database in PHP, it is important to use prepared statements to prevent SQL injection attacks. Additionally, it is recommended to sanitize user input before using it in database queries to ensure data integrity. Finally, always remember to close the database connection after performing the necessary operations. 

// Connect to the database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare a SQL statement using a prepared statement
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Sanitize user input
$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);

// Execute the statement
$stmt->execute();

// Process the retrieved data
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // Manipulate the data as needed
    echo "Username: " . $row['username'];
}

// Close the statement and connection
$stmt->close();
$conn->close();

Keywords

SQL injection PDO prepared statements data sanitization database normalization

Related Questions