What best practices should be followed when retrieving and displaying user information in PHP after login?

When retrieving and displaying user information in PHP after login, it is important to sanitize and validate the data to prevent any security vulnerabilities such as SQL injection or cross-site scripting attacks. It is recommended to use prepared statements when querying the database to avoid SQL injection. Additionally, always verify the user's authentication status before displaying any sensitive information. 

// Verify user authentication status
session_start();
if(!isset($_SESSION['user_id'])) {
    header("Location: login.php");
    exit();
}

// Retrieve user information from the database
$user_id = $_SESSION['user_id'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :user_id");
$stmt->bindParam(':user_id', $user_id);
$stmt->execute();
$user = $stmt->fetch();

// Display user information
echo "Welcome, " . htmlspecialchars($user['username']);
echo "Your email is: " . htmlspecialchars($user['email']);

Keywords

SQL injection password hashing session management data validation cross-site scripting

Related Questions