What are the best practices for passing the ID of a record in a link to ensure that the correct record is targeted for modification in PHP?

When passing the ID of a record in a link in PHP, it is important to ensure that the ID is properly sanitized to prevent SQL injection attacks. One common best practice is to use prepared statements when querying the database to safely insert the ID into the SQL query. Additionally, you can use encryption or hashing techniques to obfuscate the ID in the link to add an extra layer of security. 

<?php
// Assuming $recordId contains the ID of the record to be targeted

// Sanitize the ID
$recordId = filter_var($recordId, FILTER_SANITIZE_NUMBER_INT);

// Prepare the SQL statement with a placeholder for the ID
$stmt = $pdo->prepare("SELECT * FROM records WHERE id = :id");
$stmt->bindParam(':id', $recordId, PDO::PARAM_INT);
$stmt->execute();

// Fetch the record using the sanitized ID
$record = $stmt->fetch(PDO::FETCH_ASSOC);

// Use the fetched record as needed
?>

Keywords

PHP record ID link modification security

Related Questions