Prepared statements and why they matter in PHP - Mini Project: Build & Apply

Prepared statements and why they matter

📖 Scenario: You are building a simple PHP script to safely insert user data into a database. This is important to prevent security problems like SQL injection, which can happen if user input is added directly to SQL commands.

🎯 Goal: Learn how to use prepared statements in PHP to safely insert data into a MySQL database.

📋 What You'll Learn

Create a MySQLi connection variable called $conn with the given parameters

Create variables $name and $email with exact values

Prepare an SQL insert statement using prepare() on $conn

Bind parameters using bind_param() with correct types and variables

Execute the prepared statement using execute()

Print "User added successfully" if insertion works

💡 Why This Matters

🌍 Real World

Prepared statements are used in real websites and apps to safely add or get data from databases without risking security.

💼 Career

Knowing prepared statements is essential for backend developers, database administrators, and anyone working with data storage to write secure and reliable code.

1

Create database connection and user data variables

Create a MySQLi connection variable called $conn connecting to host localhost, username root, password password123, and database testdb. Then create two variables: $name with value "Alice" and $email with value "[e-mail]".

PHP

<?php
// Your code here

Need a hint?

Use new mysqli(host, user, password, database) to connect.

2

Prepare the SQL insert statement

Using the $conn variable, create a prepared statement variable called $stmt by calling prepare() with the SQL string: "INSERT INTO users (name, email) VALUES (?, ?)".

PHP

<?php
$conn = new mysqli("localhost", "root", "password123", "testdb");
$name = "Alice";
$email = "[e-mail]";
// Your code here

Need a hint?

Use question marks ? as placeholders for values.

3

Bind parameters and execute the statement

Use bind_param() on $stmt to bind the variables $name and $email with types "ss". Then call execute() on $stmt.

PHP

prepare("INSERT INTO users (name, email) VALUES (?, ?)");
// Your code here

Need a hint?

Use bind_param("ss", $name, $email) to bind two string parameters.

4

Print success message

After executing the statement, print the exact text "User added successfully".

PHP

prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->bind_param("ss", $name, $email);
$stmt->execute();
// Your code here

Need a hint?

Use print("User added successfully") to show the message.