Preventing injection with prepared statements in PHP - Step-by-Step Execution

Concept Flow - Preventing injection with prepared statements

Start

↓

Prepare SQL with placeholders

↓

Bind user input to placeholders

↓

Execute statement safely

↓

Fetch results or confirm action

↓

End

This flow shows how prepared statements separate SQL code from user input to stop injection.

Execution Sample

PHP

<?php
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);
$user = $stmt->fetch();
?>

This code safely queries a user by email using a prepared statement to prevent injection.

Execution Table

Step	Action	SQL State	User Input	Result
1	Prepare statement with placeholder	SELECT * FROM users WHERE email = ?	N/A	Statement ready
2	Bind user input to placeholder	Placeholder bound to user input	[e-mail]	Input safely bound
3	Execute statement	Executing with bound input	[e-mail]	Query runs safely
4	Fetch result	Result fetched	N/A	User data retrieved
5	End	No injection risk	N/A	Safe execution complete

💡 Execution stops after fetching results safely without injection risk.

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
$stmt	null	Prepared statement object	Executed statement object	Executed statement object
$email	[e-mail]	[e-mail]	[e-mail]	[e-mail]
$user	null	null	null	User data array or false

Key Moments - 3 Insights

Why can't we just put user input directly into the SQL string?

Directly inserting user input can let attackers add harmful SQL code. The execution_table shows how prepared statements keep SQL and input separate (Step 2 and 3).

What does the placeholder '?' do in the SQL?

The '?' marks where user input goes but does not run as code. Step 1 shows the SQL with placeholders ready before input is added.

How does binding input prevent injection?

Binding treats input as data only, never code. Step 2 binds input safely, so even if input has SQL code, it won't run.

Visual Quiz - 3 Questions

Look at the execution_table, what is the SQL state after Step 1?

A SQL with placeholders ready

B SQL executed with user input

C User input inserted directly

D No SQL prepared yet

💡 Hint

Check the 'SQL State' column at Step 1 in execution_table.

At which step does the user input get safely attached to the SQL?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look for 'Bind user input to placeholder' in execution_table.

If we skipped binding and inserted input directly, what risk increases?

A Faster execution

B SQL injection attack

C No result returned

D Syntax error in PHP

💡 Hint

Refer to key_moments about why direct input is dangerous.

Concept Snapshot

Prepared statements use placeholders (?) in SQL.
User input is bound separately, not mixed with SQL code.
This stops attackers from injecting harmful SQL.
Steps: prepare SQL, bind input, execute safely, fetch results.
Always use prepared statements for database queries with user data.

Full Transcript

This visual trace shows how prepared statements prevent SQL injection in PHP. First, the SQL query is prepared with a placeholder '?'. Then, user input is bound to this placeholder, keeping it separate from the SQL code. The statement executes safely with the bound input, and results are fetched. Variables like $stmt and $email change state as the code runs. Key moments explain why direct input is dangerous and how binding protects the query. The quiz tests understanding of each step and the security benefit.

Practice

1. What is the main purpose of using prepared statements in PHP when working with databases?

easy

A. To allow multiple database connections at once

B. To prevent SQL injection by separating SQL code from user data

C. To automatically format the output of SQL queries

D. To speed up the execution of all SQL queries

Solution

1. Step 1: Understand SQL injection risks

   SQL injection happens when user input is mixed directly with SQL code, allowing attackers to change the query.

2. Step 2: Role of prepared statements

   Prepared statements separate the SQL code from the data, so user input cannot change the query structure.

3. Final Answer:

   To prevent SQL injection by separating SQL code from user data -> Option B

4. Quick Check:

   Prepared statements prevent injection = D [OK]

Hint: Prepared statements separate code and data to stop injection [OK]

Common Mistakes:

• Thinking prepared statements speed up all queries
• Believing they format output automatically
• Confusing with multiple connections

2. Which of the following is the correct way to prepare and execute a statement in PHP PDO to prevent SQL injection?

easy

A. $stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?'); $stmt->execute([$id]);

B. $stmt = $pdo->query('SELECT * FROM users WHERE id = $id');

C. $stmt = $pdo->prepare('SELECT * FROM users WHERE id = $id'); $stmt->execute();

D. $stmt = $pdo->execute('SELECT * FROM users WHERE id = ?'); $stmt->prepare([$id]);

Solution

1. Step 1: Check correct prepare syntax

   Use prepare() with placeholders like ? for parameters.

2. Step 2: Execute with parameters

   Call execute() with an array of values to bind to placeholders.

3. Final Answer:

   $stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?'); $stmt->execute([$id]); -> Option A

4. Quick Check:

   prepare + execute with array = A [OK]

Hint: Use prepare() then execute() with array for safe queries [OK]

Common Mistakes:

• Using query() with variables directly
• Putting variables inside prepare() string
• Calling execute() before prepare()

3. What will be the output of the following PHP code snippet?

$stmt = $pdo->prepare('SELECT name FROM users WHERE id = ?');
$stmt->execute([2]);
$result = $stmt->fetchColumn();
echo $result;

Assuming the user with id 2 has the name 'Alice'.

medium

A. 2

B. Array

C. Alice

D. Error

Solution

1. Step 1: Understand prepare and execute

   The statement prepares a query with a placeholder and executes it with id = 2.

2. Step 2: Fetch the result

   fetchColumn() returns the first column of the first row, which is the name 'Alice'.

3. Final Answer:

   Alice -> Option C

4. Quick Check:

   fetchColumn returns name 'Alice' = C [OK]

Hint: fetchColumn() returns first column value from executed statement [OK]

Common Mistakes:

• Expecting fetchColumn() to return an array
• Confusing id with name output
• Not passing parameters to execute()

4. Identify the error in this PHP code that uses prepared statements:

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(':email' => $email);

medium

A. execute() should be called before prepare()

B. The placeholder should be a question mark (?) instead of :email

C. prepare() cannot use named placeholders like :email

D. The execute() method argument should be an array, but syntax is incorrect

Solution

1. Step 1: Check placeholder usage

   Named placeholders like :email are valid in prepare statements.

2. Step 2: Check execute() argument syntax

   execute() expects an array, but ':email' => $email is not inside an array here.

3. Final Answer:

   The execute() method argument should be an array, but syntax is incorrect -> Option D

4. Quick Check:

   execute() needs array argument = A [OK]

Hint: Pass parameters as array to execute() [OK]

Common Mistakes:

• Using wrong placeholder style
• Passing parameters without array brackets
• Calling execute() before prepare()

5. You want to insert multiple user records safely using prepared statements in PHP. Which approach correctly prevents SQL injection and efficiently inserts multiple rows?

$users = [
  ['name' => 'John', 'email' => '[e-mail]'],
  ['name' => 'Jane', 'email' => '[e-mail]']
];
// Which code below is correct?

hard

A. foreach ($users as $user) {
$stmt = $pdo->prepare('INSERT INTO users (name, email) VALUES (?, ?)');
$stmt->execute([$user['name'], $user['email']]);
}

B. $stmt = $pdo->prepare('INSERT INTO users (name, email) VALUES (?, ?)');
$stmt->execute($users);

C. foreach ($users as $user) {
$sql = "INSERT INTO users (name, email) VALUES ('{$user['name']}', '{$user['email']}')";
$pdo->query($sql);
}

D. $sql = 'INSERT INTO users (name, email) VALUES (?, ?)';
$stmt = $pdo->prepare($sql);
$stmt->execute();

Solution

1. Step 1: Check safe insertion of multiple rows

   foreach ($users as $user) { $stmt = $pdo->prepare('INSERT INTO users (name, email) VALUES (?, ?)'); $stmt->execute([$user['name'], $user['email']]); } prepares once per iteration and executes with user data safely bound as parameters.

2. Step 2: Analyze other options

   $stmt = $pdo->prepare('INSERT INTO users (name, email) VALUES (?, ?)'); $stmt->execute($users); passes array of arrays directly to execute(), which is invalid. foreach ($users as $user) { $sql = "INSERT INTO users (name, email) VALUES ('{$user['name']}', '{$user['email']}')"; $pdo->query($sql); } uses string interpolation risking injection. $sql = 'INSERT INTO users (name, email) VALUES (?, ?)'; $stmt = $pdo->prepare($sql); $stmt->execute(); calls execute() without parameters.

3. Final Answer:

   foreach ($users as $user) { $stmt = $pdo->prepare('INSERT INTO users (name, email) VALUES (?, ?)'); $stmt->execute([$user['name'], $user['email']]); } -> Option A

4. Quick Check:

   Prepare and execute per user with parameters = B [OK]

Hint: Prepare inside loop and execute with user data array [OK]

Common Mistakes:

• Passing multidimensional array directly to execute()
• Using string interpolation instead of parameters
• Calling execute() without parameters