Preventing injection with prepared statements in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is SQL injection?

SQL injection is a security risk where attackers insert harmful SQL code into input fields to manipulate or access the database in unauthorized ways.

beginner

What are prepared statements in PHP?

Prepared statements are a way to safely run SQL queries by separating the SQL code from the data, which helps prevent SQL injection.

intermediate

How do prepared statements prevent SQL injection?

They treat user input as data only, never as part of the SQL command, so harmful code can't change the query's meaning.

beginner

Show a simple PHP example using prepared statements to insert a username safely.

$pdo = new PDO($dsn, $user, $pass); $stmt = $pdo->prepare('INSERT INTO users (username) VALUES (:username)'); $stmt->execute(['username' => $inputUsername]);

beginner

Why is it unsafe to directly insert user input into SQL queries?

Because attackers can add SQL code in the input that changes the query, leading to data leaks, data loss, or unauthorized access.

What does a prepared statement do in PHP?

A Separates SQL code from data to prevent injection

B Automatically encrypts the database

C Deletes user input before running SQL

D Runs SQL queries faster by caching

Prepared statements separate SQL commands from user data, stopping harmful input from changing the query.

Which PHP function is used to prepare a SQL statement?

A prepare()

B execute()

C query()

D fetch()

The prepare() function creates a prepared statement that can be safely executed with user data.

Why should you avoid inserting user input directly into SQL strings?

A It uses more memory

B It makes the code run slower

C It can cause SQL injection attacks

D It is harder to read

Direct insertion allows attackers to add harmful SQL code, risking security.

What does the execute() method do in prepared statements?

A Closes the database connection

B Runs the prepared SQL query with given data

C Prepares the SQL query

D Fetches results from the database

execute() runs the prepared statement using the data you provide safely.

Which of these is a benefit of using prepared statements?

A Encrypts user passwords

B Automatically backs up the database

C Makes the website load faster

D Prevents SQL injection

Prepared statements protect your database by stopping SQL injection attacks.

Explain how prepared statements help prevent SQL injection in PHP.

Think about how the database sees the input versus the command.

Describe the steps to safely insert user input into a database using prepared statements in PHP.

Remember the order: connect, prepare, execute.