What is PHP PDO? Secure Database Connections & SQL Injection Prevention

Why Use PHP PDO?

PDO (PHP Data Objects) is the modern, secure database abstraction layer in PHP. Deprecated legacy extensions like mysql_* were removed in PHP 7. PDO provides cross-database compatibility and built-in protection against SQL Injection.

Secure Connection Boilerplate

$dsn = "mysql:host=localhost;dbname=dbname;charset=utf8mb4";
$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
];
$pdo = new PDO($dsn, $username, $password, $options);

Prepared Statements vs SQL Injection

Never concatenate unsanitized user inputs into raw SQL statements. Use prepared statements with named or positional parameters:

$stmt = $pdo->prepare("SELECT id, email FROM users WHERE email = :email");
$stmt->execute(['email' => $_POST['email']]);
$user = $stmt->fetch();