What are the best practices for saving form data in a database using PHP?

When saving form data in a database using PHP, it is important to sanitize the input to prevent SQL injection attacks. It is also crucial to validate the data to ensure it meets the required format before saving it to the database. Additionally, using prepared statements can help prevent SQL injection and improve performance. 

<?php
// Connect to the database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Sanitize and validate form data
$name = mysqli_real_escape_string($conn, $_POST['name']);
$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);

// Prepare SQL statement
$stmt = $conn->prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->bind_param("ss", $name, $email);

// Execute the statement
$stmt->execute();

// Close the statement and connection
$stmt->close();
$conn->close();
?>

Keywords

SQL injection prepared statements PDO data validation database normalization

Related Questions