What steps can be taken to prevent SQL injections in the PHP login-script code?

SQL injections can be prevented in a PHP login-script code by using prepared statements with parameterized queries instead of directly inserting user input into SQL queries. This helps to sanitize the input and prevent malicious SQL code from being executed. 

// Using prepared statements to prevent SQL injections in PHP login script
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

// Check if the user exists and the password is correct
if($stmt->rowCount() > 0) {
    // User authenticated, proceed with login
} else {
    // Invalid credentials, show error message
}

Keywords

SQL injection PHP prepared statements parameterized queries input validation

Related Questions