MySQLi Prepared Statements: The Right Way to Stop SQL Injection

Roshan JhaOctober 11, 2026 · 1 views

SQL injection is still one of the most common vulnerabilities on PHP websites. The fix is simple: never concatenate user input into SQL.

The vulnerable way

$sql = "SELECT * FROM users WHERE email = '" . $_POST['email'] . "'";

The safe way

$stmt = $db->prepare("SELECT * FROM users WHERE email = ?");\n$stmt->bind_param("s", $_POST['email']);\n$stmt->execute();\n$user = $stmt->get_result()->fetch_assoc();

Write a tiny helper

Wrap prepare, bind and execute in a helper function that detects parameter types automatically. Your code stays short and every query is safe by default.

Bonus tips

• Enable mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT)
• Use utf8mb4 charset
• Hash passwords with password_hash()