What are the best practices for securing user input in PHP database queries?

When dealing with user input in PHP database queries, it is essential to sanitize and validate the input to prevent SQL injection attacks. One of the best practices is to use prepared statements with parameterized queries, which separate the SQL query logic from the user input. This helps to ensure that user input is treated as data rather than executable code. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Sanitize and validate user input
$userInput = $_POST['input'];
$filteredInput = filter_var($userInput, FILTER_SANITIZE_STRING);

// Prepare a SQL query using a parameterized query
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $filteredInput, PDO::PARAM_STR);
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

Keywords

SQL injection prepared statements parameterized queries input validation PDO

Related Questions