What are the best practices for handling URL parameters in PHP when retrieving data from a database and displaying it on a webpage?

When handling URL parameters in PHP to retrieve data from a database and display it on a webpage, it's important to sanitize and validate the parameters to prevent SQL injection attacks and ensure data integrity. One common approach is to use prepared statements with placeholders to safely pass parameters to database queries. 

// Retrieve data based on URL parameter
if(isset($_GET['id'])) {
    $id = $_GET['id'];
    
    // Sanitize and validate the parameter
    $id = filter_var($id, FILTER_SANITIZE_NUMBER_INT);
    
    // Prepare and execute a database query using a prepared statement
    $stmt = $pdo->prepare("SELECT * FROM table WHERE id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();
    
    // Fetch and display the data
    $row = $stmt->fetch(PDO::FETCH_ASSOC);
    echo $row['column_name'];
}

Keywords

URL parameters PHP database retrieval data display webpage.

Related Questions