PHP and MySQL with PDO

PDO (PHP Data Objects) is the modern, secure way to connect PHP to MySQL. It supports prepared statements which eliminate SQL injection vulnerabilities.

Open a database connection using a DSN (Data Source Name):

<?php
$dsn = 'mysql:host=localhost;dbname=myapp;charset=utf8mb4';
$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,
];

try {
    $pdo = new PDO($dsn, 'appuser', 's3cr3t', $options);
} catch (PDOException $e) {
    error_log($e->getMessage());
    die('Database connection failed.');
}

Use prepared statements for any query that includes external input. This protects against SQL injection:

<?php
// SELECT with a prepared statement
$stmt = $pdo->prepare('SELECT id, name, price FROM products WHERE price < ?');
$stmt->execute([50]);
$rows = $stmt->fetchAll();

foreach ($rows as $row) {
    echo $row['name'] . ": $" . $row['price'] . "\n";
}

// INSERT
$insert = $pdo->prepare('INSERT INTO products (name, price) VALUES (?, ?)');
$insert->execute(['Widget C', 24.99]);
$newId = $pdo->lastInsertId();

Never concatenate user input into a SQL string; that is how SQL injection happens. Always use ? placeholders or named placeholders (:name) in prepared statements.