Skip to content
PHP Logo

What are the recommended steps to securely update user data in a PHP form based on user input?

To securely update user data in a PHP form based on user input, it is essential to sanitize and validate the input data before updating the database. This helps prevent SQL injection attacks and ensures that only valid data is stored. Additionally, using prepared statements with parameterized queries can further enhance the security of the update process.

php 
// Sanitize and validate user input
$user_id = filter_var($_POST['user_id'], FILTER_SANITIZE_NUMBER_INT);
$new_username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);
$new_email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

// Update user data in the database
$stmt = $pdo->prepare("UPDATE users SET username = :username, email = :email WHERE id = :id");
$stmt->bindParam(':username', $new_username);
$stmt->bindParam(':email', $new_email);
$stmt->bindParam(':id', $user_id);
$stmt->execute();

Related questions