SQL Injection Prevention

SQL injection occurs when untrusted input changes command structure. Prepared statements bind values separately and are the primary defense.

Practical example

<?php
$stmt = $pdo->prepare('SELECT id, name FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);
$allowedOrder = ['name' => 'name', 'created' => 'created_at'];
$order = $allowedOrder[$requestedOrder] ?? 'name';

Placeholders cannot safely bind table/column/direction identifiers; map those from trusted allowlists. Do not rely on manual quoting or HTML escaping. Restrict database privileges, avoid verbose production errors, and review every dynamic SQL fragment.