Skip to content
PHP Logo

What are the potential pitfalls of combining multiple insert statements into a single SQL query in PHP?

Combining multiple insert statements into a single SQL query in PHP can lead to SQL injection vulnerabilities if the input data is not properly sanitized. To prevent this, you should use prepared statements with parameterized queries to securely insert data into the database.

php 
// Establish database connection
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare the insert statement
$stmt = $pdo->prepare("INSERT INTO table_name (column1, column2) VALUES (:value1, :value2)");

// Bind parameters
$stmt->bindParam(':value1', $value1);
$stmt->bindParam(':value2', $value2);

// Insert multiple rows
foreach ($data as $row) {
    $value1 = $row['value1'];
    $value2 = $row['value2'];
    $stmt->execute();
}

Related questions