---
title: "How to prevent SQL injection in PHP?"  
description: "How to prevent SQL injection in PHP?"  
author: "Anonymous User"  
published: 2013-04-17  
updated: 2013-04-17  
canonical: https://www.mindstick.com/forum/770/how-to-prevent-sql-injection-in-php  
category: "php"  
tags: ["php"]  
reading_time: 2 minutes  

---

# How to prevent SQL injection in PHP?

Hi Everyone!\
If [user input](https://www.mindstick.com/forum/159624/setting-an-enum-from-user-input) is inserted into an [SQL query](https://www.mindstick.com/forum/529/rename-table-name-and-column-name-using-sql-query) directly, the [application](https://www.mindstick.com/articles/12824/calculator-application-in-android) becomes [vulnerable](https://www.mindstick.com/news/2494/google-discovers-samsung-and-lg-phones-are-vulnerable-due-to-leaked-certificates) to [SQL injection](https://www.mindstick.com/blog/227/sql-injection), like in the following example:\
$unsafe_variable = $_POST['user_input'];\
mysql_query("[INSERT](https://www.mindstick.com/blog/173/executing-insert-delete-or-update-query-in-sqlserver-using-ado-dot-net) INTO table ([column](https://www.mindstick.com/forum/33860/how-to-calculate-column-summary-in-sql-server)) [VALUES](https://www.mindstick.com/forum/327/sum-textbox-values) ('" . $unsafe_variable . "')");That's because the user can input something like value'); [DROP TABLE](https://answers.mindstick.com/qa/116599/what-is-difference-between-delete-table-data-vs-drop-table) table;--, making the query:\
INSERT INTO table (column) VALUES('value'); DROP TABLE table;--')\
What should one do to prevent this?\
Thanks in [advance](https://www.mindstick.com/blog/33258/jee-mains-and-jee-advance-exams)!

## Replies

### Reply by AVADHESH PATEL

Hi Jayprakash!\
Use prepared statements and parameterized queries. These are SQL statements that are sent to and parsed by the database server separately from any parameters. This \
way it is impossible for an attacker to inject malicious SQL.\
You basically have two options to achieve this:\
Using PDO:\
$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');\
$stmt->execute(array(':name' => $name));\
foreach ($stmt as $row) { // do something with $row }\
Using mysqli:\
$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?'); $stmt->bind_param('s', $name);\
$stmt->execute();\
$result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { // do something with $row }\
PDO\
Note that when using PDO to access a MySQL database real prepared statements are not used by default. To fix this you have to disable the emulation of prepared \
statements. An example of creating a connection using PDO is:\
$dbConnection = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'pass');\
$dbConnection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);$dbConnection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);\
I hope it resolve your problem!\


---

Original Source: https://www.mindstick.com/forum/770/how-to-prevent-sql-injection-in-php

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.