What are the best practices for handling database queries in PHP to prevent errors like the one mentioned in the thread?

Issue: To prevent errors like SQL injection, it is important to use prepared statements when executing database queries in PHP. This helps sanitize user input and prevent malicious code from being executed. Code snippet: 

// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare a SQL statement with a parameter placeholder
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");

// Bind the parameter and execute the statement
$username = $_POST['username'];
$stmt->bind_param("s", $username);
$stmt->execute();

// Get the result set
$result = $stmt->get_result();

// Fetch and display the results
while ($row = $result->fetch_assoc()) {
    echo "Username: " . $row['username'] . "<br>";
}

// Close the statement and connection
$stmt->close();
$conn->close();

Keywords

SQL injection prepared statements PDO error handling data validation

Related Questions