Prepared statement with PDO

Php

Placeholders rather than interpolation. This is the whole of SQL injection defence in PHP.

$stmt = $pdo->prepare(
    'SELECT id, title FROM posts WHERE author_id = ? AND published = ?'
);
$stmt->execute([$authorId, 1]);
$posts = $stmt->fetchAll(PDO::FETCH_ASSOC);

Download

PHP php pdo security sql chris

More in PHP

Escape output in a PHP template PHP htmlspecialchars with the flags spelled out, because the defaults have changed between versions. Hash and verify a password in PHP PHP password_hash picks the algorithm and the salt. Never store anything a hash function can reverse.

Random picks

Which DNS records does a domain have? Networking dig with +short strips everything but the answer. YAML anchors to avoid repeating yourself Data Formats Define a block once, merge it into each service. Changing the base changes all of them. Const assertion for a lookup table TypeScript `as const` keeps the literal types, so the derived union is the actual keys rather than string. A test that fails for the right reason Testing Assert on the message, not merely that something threw. A typo raising TypeError would otherwise pass. Delete duplicate rows, keeping the oldest Databases Uses a window function to number the duplicates and removes everything but the first of each group. Compose file with a healthcheck and dependency order Containers Makes the app wait until Postgres actually answers, not merely until its container has started. Worker pool with a wait group in Go Systems Fixed number of goroutines draining a channel, with the group ensuring main waits for all of them. Result and the question mark operator in Rust Systems ? propagates the error to the caller, which is why Rust functions rarely need explicit error branches.