What are the best practices for handling database queries and results in PHP, especially when using PDO and prepared statements?

When handling database queries in PHP, especially when using PDO and prepared statements, it is important to properly sanitize input data to prevent SQL injection attacks. Additionally, using prepared statements can improve performance and security by separating SQL logic from user input. 

// Establish a database connection using PDO
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind parameters
$stmt->bindParam(':username', $username, PDO::PARAM_STR);

// Execute the query
$stmt->execute();

// Fetch results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Loop through results
foreach ($results as $row) {
    // Handle each row
}

Keywords

PDO prepared statements database queries results error handling

Related Questions