What best practices should be followed when handling user input in PHP to prevent SQL injection?

To prevent SQL injection in PHP, it is essential to use prepared statements with parameterized queries when interacting with a database. This approach separates SQL code from user input, preventing malicious SQL queries from being executed. Additionally, input validation and sanitization should be implemented to ensure that only expected data types and formats are accepted. 

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the parameter
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection user input validation prepared statements PDO escaping data

Related Questions