What potential pitfalls can occur when using placeholders incorrectly in a PHP PDO query?

Using placeholders incorrectly in a PHP PDO query can lead to SQL injection vulnerabilities, where malicious users can manipulate the query to execute unauthorized SQL commands. To prevent this, always ensure that placeholders are properly used in the query to bind user input securely. 

// Incorrect usage of placeholders in a PHP PDO query
$userInput = $_POST['username'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = '$userInput'");
$stmt->execute();

// Correct usage of placeholders to prevent SQL injection
$userInput = $_POST['username'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->bindParam(':username', $userInput);
$stmt->execute();

Keywords

PHP PDO placeholders SQL injection security

Related Questions