PHP Help Needed: How to Secure User Input in Forms?

[marcelo00salas]

Hi everyone,

I am new to PHP and learning about securing web forms. I have read that improperly handled user input can make your site vulnerable to SQL injection, XSS and other attacks.

Can someone guide me on the best practices to sanitize and validate user input in PHP: ??

Using htmlspecialchars() for escaping HTML.
Using prepared statements with PDO for SQL queries.

Are there other techniques or built-in PHP functions I should know about: ?? Also, what’s the best way to validate user data like email addresses and numbers: ??

I would appreciate examples or snippets if possible. Looking forward to learning from the experts here !!

Thanks in advance !!

With Regards,
Marcelo Tableau

[Strider64]

I would start with prepared statements - example

        $sql = "SELECT * FROM cms WHERE id=:id LIMIT 1";
        $stmt = $this->pdo->prepare($sql);
        $stmt->execute(['id' => $id]);
        $record = $stmt->fetch(PDO::FETCH_ASSOC);

A simple example of grabbing a record by its id.

Might be a little outdated but still good → https://phpdelusions.net/pdo or PHP PDO Tutorials | PHP PDO Tutorials for beginners – PHPGurukul though the last one I never used.

Then learn on how to sanitized and as I learn awhile back (I think someone from here) NEVER trust user’s input.