What are the potential pitfalls of using user input directly in SQL queries in PHP?

Using user input directly in SQL queries in PHP can lead to SQL injection attacks, where malicious users can manipulate the input to execute unauthorized SQL commands. To prevent this, you should always sanitize and validate user input before using it in SQL queries. One way to do this is by using prepared statements with parameterized queries, which separate the SQL code from the user input. 

// Sanitize and validate user input
$userInput = $_POST['user_input'];
$cleanInput = filter_var($userInput, FILTER_SANITIZE_STRING);

// Prepare a SQL query using a prepared statement
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $cleanInput, PDO::PARAM_STR);
$stmt->execute();

// Fetch and process the results
while ($row = $stmt->fetch()) {
    // Process the fetched data
}

Keywords

SQL injection user input validation prepared statements PDO mysqli_prepare

Related Questions