mysql - How can I prevent SQL injection in PHP? -
if user input inserted without modification sql query, application becomes vulnerable sql injection , in following example: $unsafe_variable = $_post['user_input']; mysql_query("insert `table` (`column`) values ('$unsafe_variable')"); that's because user can input value'); drop table table;-- , , query becomes: insert `table` (`column`) values('value'); drop table table;--') what can done prevent happening? use prepared statements , parameterized queries. these sql statements sent , parsed database server separately parameters. way impossible attacker inject malicious sql. you have 2 options achieve this: using pdo (for supported database driver): $stmt = $pdo->prepare('select * employees name = :name'); $stmt->execute(array('name' => $name)); foreach ($stmt $row) { // $row } using mysqli (for mysql): $stmt = $dbconnection->prepare('select * employees name = ?');
