What potential issues can arise from not using quotation marks around string values in SQL queries?

Not using quotation marks around string values in SQL queries can lead to syntax errors or SQL injection vulnerabilities. To solve this issue, always wrap string values in single quotes to ensure they are treated as strings by the database. 

// Example of using single quotes around string values in SQL queries
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

$username = "John Doe";
$password = "password123";

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $username, PDO::PARAM_STR);
$stmt->bindParam(':password', $password, PDO::PARAM_STR);
$stmt->execute();

// Fetch results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

Keywords

SQL injection security vulnerability prepared statements mysqli_real_escape_string data sanitization

Related Questions