What are the potential pitfalls of using SELECT queries in PHP when dealing with user preferences like displaying ICQ numbers?

When using SELECT queries in PHP to fetch user preferences like displaying ICQ numbers, a potential pitfall is not properly sanitizing the input data. This can lead to SQL injection attacks where malicious code is injected into the query. To solve this issue, it is important to use prepared statements with parameterized queries to prevent SQL injection vulnerabilities. 

// Example of using prepared statements to fetch user ICQ numbers safely

// Assuming $userID is the user's ID
$userID = $_GET['userID'];

// Prepare a SELECT query with a placeholder for the user ID
$stmt = $pdo->prepare("SELECT icq_number FROM user_preferences WHERE user_id = :userID");

// Bind the user ID parameter to the placeholder
$stmt->bindParam(':userID', $userID, PDO::PARAM_INT);

// Execute the query
$stmt->execute();

// Fetch the ICQ number
$icqNumber = $stmt->fetchColumn();

// Display the ICQ number
echo "ICQ Number: " . $icqNumber;

Keywords

SELECT queries PHP user preferences ICQ numbers data validation

Related Questions