What is the purpose of using bind_param() in PHP?

When inserting user input into a SQL query in PHP, it is important to use bind_param() to prevent SQL injection attacks. This function binds parameters to a prepared statement, ensuring that user input is treated as data rather than executable code. This helps to protect the database from malicious input. 

// Prepare a SQL statement with placeholders
$stmt = $mysqli->prepare("INSERT INTO users (username, email) VALUES (?, ?)");

// Bind parameters to the placeholders
$stmt->bind_param("ss", $username, $email);

// Set the parameters and execute the statement
$username = "john_doe";
$email = "john.doe@example.com";
$stmt->execute();

Keywords

bind_param PHP MySQLi prepared statements data binding

Related Questions