What is the best practice for incorporating a $_GET passed Product_ID into an SQL query in PHP?

When incorporating a $_GET passed Product_ID into an SQL query in PHP, it is important to sanitize the input to prevent SQL injection attacks. One way to do this is by using prepared statements with parameterized queries. This helps to separate the SQL query from the user input, ensuring that the input is treated as data rather than executable code. 

// Sanitize the Product_ID from $_GET
$product_id = filter_var($_GET['Product_ID'], FILTER_SANITIZE_NUMBER_INT);

// Prepare a SQL statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM products WHERE Product_ID = :product_id");
$stmt->bindParam(':product_id', $product_id, PDO::PARAM_INT);
$stmt->execute();

// Fetch the results
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
    // Process the data
}

Keywords

PHP $_GET SQL query Product_ID security

Related Questions