What best practices should be followed when passing variables to SQL queries in PHP?

When passing variables to SQL queries in PHP, it is important to use prepared statements to prevent SQL injection attacks. This involves using parameterized queries with placeholders for the variables, which are then bound to the actual values before execution. This helps sanitize user input and ensures that the query is secure. 

// Example of passing variables to SQL queries using prepared statements
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare the SQL query with placeholders
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the variable to the placeholder
$username = $_POST['username'];
$stmt->bindParam(':username', $username);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Loop through the results
foreach ($results as $result) {
    echo $result['username'] . '<br>';
}

Keywords

SQL injection prepared statements PDO mysqli_real_escape_string parameterized queries

Related Questions