What are the potential pitfalls of passing variables through URLs in PHP for database operations?

Passing variables through URLs in PHP for database operations can lead to security vulnerabilities such as SQL injection attacks. To prevent this, it is recommended to use prepared statements with parameterized queries to sanitize and validate user input before executing database operations. 

// Example of using prepared statements to prevent SQL injection

// Get the variable from the URL
$id = $_GET['id'];

// Prepare a SQL statement with a placeholder for the variable
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");

// Bind the variable to the placeholder
$stmt->bindParam(':id', $id, PDO::PARAM_INT);

// Execute the query
$stmt->execute();

// Fetch the results
$user = $stmt->fetch();

Keywords

SQL injection security vulnerability GET method urlencode prepared statements

Related Questions