What are the potential pitfalls of using addslashes() in PHP scripts for database outputs?

Using addslashes() to escape special characters in database outputs can lead to SQL injection vulnerabilities if not used properly. It is recommended to use prepared statements with parameterized queries instead, as they provide a safer and more reliable way to interact with databases. 

// Using prepared statements with parameterized queries to safely retrieve data from the database

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $username, PDO::PARAM_STR);
$stmt->execute();
$result = $stmt->fetch(PDO::FETCH_ASSOC);

// Output the data from the database
echo $result['username'];

Keywords

addslashes SQL injection database security data sanitization escaping characters

Related Questions