PHP Academy · Lesson

SQL Injection and Parameterized Queries

Eliminate injection risks by always using prepared statements with PDO.

SQL Injection and Parameterized Queries is a free PHP Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is SQL Injection?

SQL injection occurs when user-supplied data is embedded directly in a SQL query, allowing attackers to manipulate the query to access, modify, or delete data.

Classic Example

Concatenating user input into SQL:

<?php
// VULNERABLE: attacker enters username = "' OR '1'='1"
$sql = "SELECT * FROM users WHERE username = '".$_GET["username"]."'";
// Becomes: SELECT * FROM users WHERE username = '' OR '1'='1'
// Returns ALL users!

Data Exfiltration Example

An attacker uses UNION SELECT to leak data from other tables.

// Input: ' UNION SELECT username, password FROM admin_users--
// This appends a second SELECT returning admin credentials

Prepared Statements Are the Solution

With prepared statements, the query structure is fixed before any data is provided. The database treats all bound values as literal data — never as SQL code.

<?php
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$_GET["username"]]);
// Safe even if username = "' OR 1=1--"

Named Placeholders

Named placeholders are clearer, especially with multiple parameters.

<?php
$stmt = $pdo->prepare(
    "SELECT * FROM users WHERE email = :email AND active = :active"
);
$stmt->execute([":email" => $email, ":active" => true]);

Eloquent Is Safe by Default

Laravel Eloquent uses PDO prepared statements internally for all standard query builder operations.

<?php
// Safe:
User::where("email", $email)->first();

// UNSAFE: raw query with user input!
DB::select("SELECT * FROM users WHERE email = ".$email);

Raw Queries

When you must use raw SQL in Laravel, always use parameter bindings.

<?php
// Safe raw query:
$users = DB::select("SELECT * FROM users WHERE email = ?", [$email]);

// Or with named bindings:
$users = DB::select("SELECT * FROM users WHERE email = :email", [":email" => $email]);

LIKE Clause Injection

LIKE clauses need special handling — wildcard characters (%, _) must be escaped manually before binding.

<?php
$search = str_replace(["%", "_", "\\"], ["\%", "\_", "\\\\"], $userInput);
$stmt = $pdo->prepare("SELECT * FROM products WHERE name LIKE ?");
$stmt->execute(["%$search%"]);

ORDER BY Injection

Column names and ORDER BY directions cannot be parameterised. Validate against a whitelist.

<?php
$allowedColumns = ["name", "price", "created_at"];
$col = in_array($request->sort, $allowedColumns) ? $request->sort : "name";
$dir = $request->dir === "desc" ? "desc" : "asc";
// Then safely build the query string

Stored Procedures

Stored procedures can also be vulnerable if they concatenate input internally. Always use parameterised calls.

Principle of Least Privilege

The database user connecting from PHP should only have SELECT/INSERT/UPDATE/DELETE on necessary tables — never CREATE, DROP, or admin privileges.

Summary

ALWAYS use prepared statements with bound parameters. Never concatenate user input into SQL. Validate ORDER BY and column names against a whitelist. Use PDO with emulated prepares disabled.

Quick Check

What is the correct way to protect against SQL injection?

Frequently asked questions

Is the “SQL Injection and Parameterized Queries” lesson free?

Yes — the full text of “SQL Injection and Parameterized Queries” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.

What will I learn in “SQL Injection and Parameterized Queries”?

Eliminate injection risks by always using prepared statements with PDO. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start PHP Academy?

No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “SQL Injection and Parameterized Queries” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this PHP Academy lesson?

Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to PHP Academy