Question

How to run SQL query on MySQL with PHP Data Objects (PDO) for increased security in PHP

Answer 1

$db_host = 'localhost';
$db_user = 'user';
$db_password = 'password';
$db_name = 'database_name';
 
try
{
    $con = new PDO("mysql:host=".$db_host.";dbname=".$db_name, $db_user, $db_password);
}
catch(PDOException $e)
{
    echo "Connection failed: " . $e->getMessage();
}
 
$result = $con->prepare("SELECT user_id, firstname, lastname, email
                         FROM wf_users
                         WHERE email = :email
                         AND password = :password");  

$result->bindParam(':email', $_POST['email'], PDO::PARAM_STR);
$result->bindParam(':password', $_POST['password'], PDO::PARAM_STR);

$result->execute();
                
$row = $result->fetch(PDO::FETCH_ASSOC); // get the first row only

echo $row['email'];

// if it didn't work - check for errors with:
$r = $result->errorInfo();
echo $r;

// if $r is:
/*
: array = 
  0: string = "00000"
  1: undefined = NULL
  2: undefined = NULL
*/
// then the query run without errors

70+ SQL courses for beginners and professionals