What are the potential pitfalls of constructing SQL commands from concatenated strings in PHP?

Constructing SQL commands from concatenated strings in PHP can lead to SQL injection vulnerabilities, where malicious users can manipulate the query to execute unauthorized commands on the database. To prevent this, you should use prepared statements with parameterized queries, which separate the SQL logic from the user input. 

// Example of using prepared statements to prevent SQL injection

// Establish a database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a SQL statement with a parameter
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the parameter with user input
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Use the results as needed
foreach ($results as $row) {
    echo $row['username'] . "<br>";
}

Keywords

SQL injection security vulnerability prepared statements PDO escaping data

Related Questions