Interview question
How do you prevent SQL injection in PHP database queries? PHP database queries में SQL injection कैसे रोकें?
Answer
SQL injection happens when untrusted input is concatenated directly into a SQL query, letting attackers alter query logic.
Vulnerable:
An input like
Safe:
$sql = "SELECT * FROM users WHERE email = '$email'";An input like
' OR '1'='1 bypasses the WHERE clause entirely.Safe:
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);| Practice | Why it helps |
|---|---|
| Prepared statements | Separates code from data |
| Input validation | Rejects malformed input early |
| Least privilege DB user | Limits damage if breached |
SQL injection तब होता है जब untrusted input सीधे SQL query में जोड़ दिया जाता है।
असुरक्षित:
सुरक्षित:
$sql = "SELECT * FROM users WHERE email = '$email'";सुरक्षित:
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);Was this answer clear?