Mastering PHP PDO Connection & Preventing SQL Injection

Security is the most important element of modern web application development. Core PHP applications often suffer from SQL injection due to dynamic SQL query concatenation. PDO (PHP Data Objects) is the best solution built natively into PHP.

Why use PDO?

1. Prepared Statements: Separation of query logic and parameter data.
2. Database Portability: Works with MySQL, PostgreSQL, SQLite, etc.
3. Object Mapping: Map database rows to custom PHP class objects.

Creating a Secure Connection

try {
    $pdo = new PDO("mysql:host=$host;dbname=$db;charset=utf8mb4", $user, $pass, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES => false,
    ]);
} catch (PDOException $e) {
    die("Database Connection failed!");
}