All 7 Security questions
More in Security
What is cross site scripting, commonly called XSS, and how does properly escaping output help prevent it? Why should passwords always be hashed before storing them in a database, and how does PHP's password_hash function make this straightforward and secure? What is cross site request forgery, commonly called CSRF, and how do CSRF tokens help protect forms from this type of attack? Why is validating and sanitizing file uploads important, and what specific checks should you perform to prevent an attacker from uploading a malicious file? What is the principle of least privilege, and how should it guide decisions about database user permissions and environment configuration in a PHP application? How can PHP's built in disabled functions setting and other server level configuration hardening reduce the impact of a successful attack against an application?
Advertisement
PHP › Security

What is SQL injection, and how does using prepared statements with PDO help prevent this common vulnerability in PHP applications?

Beginner

Answer

SQL injection happens when untrusted user input is inserted directly into a SQL query string, allowing an attacker to manipulate the query itself and potentially read, modify, or delete data they should never have access to, and prepared statements prevent this by sending the query structure and the user supplied values to the database separately, so the values are always treated as plain data and never as part of the executable query, no matter what characters they contain.
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);
Real-world example A login form uses a prepared statement to check a submitted email address against the database, ensuring that even if an attacker types something like a quote followed by SQL commands into the email field, it is safely treated as a literal string rather than being executed as part of the query.

Common follow-ups: What other types of injection attacks exist besides SQL injection?;Can prepared statements alone fully protect an application from every security risk?

PDO & Databases;Form Handling & Validation
All 7 Security questions