What potential pitfalls should be avoided when using multiple SQL queries in PHP?

When using multiple SQL queries in PHP, it is important to avoid SQL injection vulnerabilities by properly sanitizing user input. Additionally, be cautious of potential performance issues that may arise from executing multiple queries sequentially instead of using JOINs or subqueries to combine them into a single query. 

// Example of using prepared statements to prevent SQL injection
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a SQL statement with a placeholder for user input
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set the user input and execute the query
$username = "john_doe";
$stmt->execute();

// Bind the results to variables
$stmt->bind_result($id, $username, $email);

// Fetch the results
$stmt->fetch();

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

SQL injection prepared statements PDO mysqli error handling

Related Questions