Skip to content
PHP Logo

What best practices should be followed when querying a MySQL database in PHP to prevent SQL injection attacks?

SQL injection attacks can occur when user input is not properly sanitized before being used in SQL queries, allowing malicious users to manipulate the query to perform unauthorized actions on the database. To prevent SQL injection attacks, it is important to always use prepared statements with parameterized queries when querying a MySQL database in PHP. This ensures that user input is treated as data rather than executable code, making it impossible for attackers to inject malicious SQL commands.

php 
// Establish a connection to the database
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check for connection errors
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a SQL statement with a parameterized query
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set the parameter values and execute the query
$username = $_POST['username'];
$stmt->execute();

// Fetch the results
$result = $stmt->get_result();

// Process the results as needed
while ($row = $result->fetch_assoc()) {
    // Do something with the data
}

// Close the statement and connection
$stmt->close();
$mysqli->close();

Related questions