1SQL injection is a common attack vector that allows attackers to interfere with the queries that an application makes to its database. This article focuses on prevention techniques in PHP applications. By understanding how SQL injection works and implementing best practices, developers can reduce the attack surface and protect their applications from vulnerabilities.
2
3## Understanding SQL Injection
4
5SQL injection occurs when an attacker can manipulate the queries an application sends to the database by inserting or "injecting" malicious SQL code. This is often due to improper handling of user input. A basic example is a login form where an attacker inputs `' OR 1=1 --` to bypass authentication.
6
7```php
8<?php
9`$username = $`_POST['username'];
10`$password = $`_POST['password'];
11`$query = "SELECT * FROM users WHERE username = '$`username' AND password = '$password'";
12`$result = mysqli_query($`conn, $query);

SELECT * FROM users WHERE username = '' OR 1=1 --' AND password = ''

1<?php
2`$conn = new mysqli($`servername, $`username, $`password, $dbname);
3
4// Prepare statement
5`$stmt = $`conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
6`$stmt->bind_param("ss", $`username, $password);
7
8// Execute the prepared statement
9$stmt->execute();
10`$result = $`stmt->get_result();

1<?php
2`$pdo = new PDO("mysql:host=$`servername;dbname=$`dbname", $`username, $password);
3`$stmt = $`pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
4`$stmt->execute(['username' => $`username, 'password' => $password]);
5`$result = $`stmt->fetch();

<?php
$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
$password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING);

1<?php
2`$username = $`conn->real_escape_string($_POST['username']);
3`$password = $`conn->real_escape_string($_POST['password']);
4`$query = "SELECT * FROM users WHERE username = '$`username' AND password = '$password'";
5`$result = mysqli_query($`conn, $query);