What best practices should be followed when fetching data from a database to populate an RSS feed in PHP?

When fetching data from a database to populate an RSS feed in PHP, it is important to sanitize the data to prevent SQL injection attacks and ensure that the feed is well-formed and valid. Use prepared statements to safely query the database and escape special characters in the output to prevent XSS attacks. 

// Connect to database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare SQL statement
$stmt = $pdo->prepare("SELECT * FROM articles");
$stmt->execute();

// Start RSS feed
header("Content-Type: application/rss+xml; charset=UTF-8");
echo '<?xml version="1.0" encoding="UTF-8"?>';
echo '<rss version="2.0">';
echo '<channel>';
echo '<title>My RSS Feed</title>';
echo '<link>http://www.example.com</link>';
echo '<description>Latest articles from my website</description>';

// Fetch data and populate feed
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
    echo '<item>';
    echo '<title>' . htmlspecialchars($row['title']) . '</title>';
    echo '<link>' . htmlspecialchars($row['url']) . '</link>';
    echo '<description>' . htmlspecialchars($row['description']) . '</description>';
    echo '</item>';
}

// End RSS feed
echo '</channel>';
echo '</rss>';

Keywords

SQL injection PDO prepared statements XML manipulation error handling

Related Questions