What measures should be implemented when the search keyword for a select query to a database comes from the script itself?

When the search keyword for a select query comes from the script itself, it is important to sanitize the input to prevent SQL injection attacks. One way to do this is by using prepared statements with parameterized queries, which separate the SQL query logic from the user input. This helps to ensure that the input is treated as data and not as executable SQL code. 

// Assuming $searchKeyword contains the search term from the script

// Establish a database connection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a SQL statement with a placeholder for the search term
$stmt = $pdo->prepare("SELECT * FROM mytable WHERE column_name = :searchTerm");

// Bind the search term parameter to the placeholder
$stmt->bindParam(':searchTerm', $searchKeyword);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Process the results as needed
foreach ($results as $result) {
    // Do something with each result
}

Keywords

SQL injection prepared statements PDO mysqli_real_escape_string input validation

Related Questions