How can you prevent SQL Injection in PHP?

SQL injection is a type of attack where an attacker can inject malicious SQL code into a database query, which can lead to data theft or modification. To prevent SQL injection in PHP, you can follow these best practices:

1. Use prepared statements: Prepared statements are a powerful tool for preventing SQL injection attacks. By using placeholders for input values in your queries and binding the input values separately, you can ensure that the input values are properly escaped and prevent the injection of malicious SQL code. For example, using PDO, you can prepare a statement like this:

$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');
$stmt->bindParam(':username', $username);
$stmt->execute();

2. Validate input data: Always validate user input data to ensure that it meets the expected format and type. For example, you can use regular expressions or other validation functions to ensure that user input contains only letters or numbers.
3. Sanitize input data: Even if you validate user input data, it is still important to sanitize it before using it in a query. Sanitizing means removing any potentially harmful characters or data from user input. For example, you can use the filter_var() function in PHP to sanitize user input:

$username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);

4. Limit privileges: Limit the privileges of the database user account used by your PHP application. For example, if your PHP application only needs to read data from the database, you can create a user account that only has read privileges and use that account in your PHP code.
5. Use a trusted library or framework: Use a trusted PHP library or framework that provides built-in protection against SQL injection attacks. Many popular PHP frameworks, such as Laravel and Symfony, include features for preventing SQL injection.

By following these best practices, you can significantly reduce the risk of SQL injection attacks in your PHP application.