What best practices should be followed when querying a database for data in PHP?

When querying a database for data in PHP, it is important to use prepared statements to prevent SQL injection attacks. Prepared statements separate SQL logic from user input, making it safer to execute queries. Additionally, it is recommended to sanitize and validate user input before using it in a query to ensure data integrity. 

// Connect to database
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a statement
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind parameters
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

// Loop through results
foreach ($results as $row) {
    echo $row['username'] . '<br>';
}

Keywords

SQL injection PDO prepared statements error handling database normalization

Related Questions