What best practices should be followed when selecting data from a database in PHP, especially when dealing with sensitive information like email addresses?

When selecting data from a database in PHP, especially when dealing with sensitive information like email addresses, it is important to use prepared statements to prevent SQL injection attacks. This involves binding parameters to the query rather than directly inserting user input into the SQL statement. Additionally, it is recommended to sanitize user input to prevent any malicious code from being executed. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a placeholder for the email address
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');

// Bind the email address parameter to the placeholder
$stmt->bindParam(':email', $email, PDO::PARAM_STR);

// Sanitize the email address input
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection PDO prepared statements encryption data validation

Related Questions