What are the best practices for retrieving and inserting data from a database in PHP?

When retrieving data from a database in PHP, it is best practice to use prepared statements to prevent SQL injection attacks. When inserting data into a database, sanitize user input to prevent malicious code execution. It is also recommended to establish a secure database connection using PDO or MySQLi. 

// Retrieving data from a database using prepared statements
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
$stmt->execute(['id' => $userId]);
$user = $stmt->fetch();

// Inserting data into a database with sanitized input
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

$stmt = $pdo->prepare('INSERT INTO users (name, email) VALUES (:name, :email)');
$stmt->execute(['name' => $name, 'email' => $email]);

Keywords

SQL injection PDO prepared statements mysqli data validation

Related Questions