Prepared statements and why they matter in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a prepared statement in PHP?

A prepared statement is a feature that lets you write a SQL query template with placeholders. You fill in the placeholders later with actual values before running the query. This helps keep your database safe and your code efficient.

beginner

Why do prepared statements help prevent SQL injection?

Prepared statements separate the SQL code from the data. This means user input is treated only as data, not as part of the SQL command. So, attackers cannot change the query by injecting harmful SQL code.

intermediate

How do prepared statements improve performance?

The database server compiles the SQL query once, then runs it many times with different data. This saves time because the server doesn’t have to parse and plan the query each time.

beginner

Show a simple PHP example of using a prepared statement to select a user by ID.

$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?'); $stmt->execute([$userId]); $user = $stmt->fetch();

beginner

What happens if you don’t use prepared statements and insert user input directly into SQL?

If you insert user input directly, attackers can add SQL code that changes your query. This can lead to data leaks, data loss, or unauthorized access. This is called SQL injection.

What is the main security benefit of using prepared statements?

A They make the website load faster

B They prevent SQL injection attacks

C They allow multiple users to connect at once

D They automatically encrypt data

Prepared statements keep SQL code and data separate, stopping attackers from injecting harmful SQL.

In PHP, which method prepares a SQL statement for execution?

A $pdo->execute()

B $pdo->query()

C $pdo->fetch()

D $pdo->prepare()

The prepare() method creates a prepared statement with placeholders.

What symbol is commonly used as a placeholder in prepared statements?

A #

B &

C ?

D $

The question mark (?) is used as a placeholder for values in prepared statements.

Which of these is NOT a benefit of prepared statements?

A Automatic data encryption

B Improved security

C Better performance

D Cleaner code

Prepared statements do not encrypt data automatically.

What happens if you execute a prepared statement multiple times with different data?

A The query runs faster because it’s compiled once

B The database recompiles the query each time

C The query fails after the first execution

D The data is ignored

Prepared statements compile the query once, so running it multiple times with new data is faster.

Explain in your own words why prepared statements are important for database security.

Think about how attackers try to change SQL queries.

Describe the steps to use a prepared statement in PHP to safely query a database.

Remember the order: prepare, execute, fetch.