What are the common mistakes to avoid when working with SQL queries in PHP functions to fetch and display data from a database?

Common mistakes to avoid when working with SQL queries in PHP functions include not sanitizing user input, not using prepared statements to prevent SQL injection attacks, and not properly handling errors when executing queries. To avoid these issues, always sanitize user input, use prepared statements with parameter binding, and implement error handling to catch any potential issues that may arise. 

// Example of a correct way to fetch and display data from a database using prepared statements

// Establish database connection
$connection = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($connection->connect_error) {
    die("Connection failed: " . $connection->connect_error);
}

// Prepare SQL statement with a placeholder for user input
$stmt = $connection->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Sanitize user input
$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);

// Execute the query
$stmt->execute();
$result = $stmt->get_result();

// Display the fetched data
while ($row = $result->fetch_assoc()) {
    echo "Username: " . $row['username'] . "<br>";
}

// Close the statement and connection
$stmt->close();
$connection->close();

Keywords

SQL injection prepared statements PDO mysqli data validation

Related Questions