PDO (PHP Data Objects) shine PHP na zamani, interface mara dogaro da database don shigowa cikin databases. Mahimman fasalin sa ne prepared statements, wanda ke haqdade SQL injection — muhimmin aiki na aminci ga kowane code na database.
= (
,
, ,
[
PDO:: => PDO::, // exceptions on errors
PDO:: => PDO::, // fetch rows associative arrays
]
);
PDO yana aiki kwatance da databases (MySQL, PostgreSQL, SQLite, da sauransu) tare da API ɗaya. Saita ERRMODE_EXCEPTION yana sa kuhanin database suka tashi su zama exceptions da za a iya kama su.
// ❌ NEVER do this — concatenating user input → SQL INJECTION vulnerability
$result = $pdo->query("SELECT * FROM users WHERE id = " . $_GET['id']);
// input "1 OR 1=1" or "1; DROP TABLE users" → disaster
// ✅ ALWAYS use prepared statements with bound parameters
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ? AND active = ?");
$stmt->execute([$_GET['id'], true]); // parameters bound SAFELY
$user = $stmt->fetch();
// named parameters work too
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute(["email" => $email]);
Prepared statements suna aika SQL da bayanan daban-daban - database yana daukin parameters azaman bayanan tsaf fiye, ba a matsayin SQL da za a bugi. Wannan yana sa injection ba sa yiwuwa, ko wane abin da mai amfani ya shigar. Wannan ba shi da lokaci na tunawa ga kowane bugun da ake haɗa da abin da mai amfani ya sanya.
$stmt->fetch(); // one row (associative array)
$stmt->fetchAll(); // all rows
$stmt->fetchColumn(); // a single value
// INSERT/UPDATE/DELETE — also use prepared statements
$stmt = $pdo->prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->execute([$name, $email]);
$pdo->lastInsertId(); // the new row's ID
$pdo->beginTransaction();
try {
$pdo->prepare("UPDATE accounts SET balance = balance - ? WHERE id = ?")->execute([$amt, $from]);
$pdo->prepare("UPDATE accounts SET balance = balance + ? WHERE id = ?")->execute([$amt, $to]);
$pdo->commit(); // all-or-nothing
} catch (Throwable $e) {
$pdo->rollBack(); // undo on failure
}
Saukar database cikin aminci shine ɗaya daga cikin muhimman gidu na aminci na PHP development, kuma PDO tare da prepared statements shine muhimman aiki kowa mai yada PHP ya dace ya sani.
SQL injection — wanda aka haifar da haɗa abin da ba a amince da shi daga mai amfani kai tsaye cikin bugun SQL — shine ɗaya daga cikin abubuwan dambe da mahimmanci na yanar gizon yanar gida (yana ba da damar ƙagara su karantawa, canza, ko hallaka bayanan), kuma ba ta maru. Prepared statements tare da ɗing bayanan ne mafita: ta aika tsarin SQL da bayanan daban-daban, database yana daukin abin da mai amfani sai azaman bayanan tsaf da ba za su bugi a matsayin SQL, yana sa injection ba sa yiwuwa koina inda aka shigar. // Fahimtar cewa dole ka yi amfani da prepared statements kuma koyaushe ga kowane bugun da ake haɗa da abin da mai amfani ya sanya (ba haɗa jiya-jiya ba) ba shi da lokaci na tunawa, muhimmin ilimi na aminci. "];Banar aminci, PDO's database-agnostic interface, exception-based shawara, sannu na sakamakon ƙaure, da ƙirja gida yana sa shi mai ƙarfi, zamani na gida don shigowa cikin databases a PHP. "); Saboda shigowa cikin database shine mahimmanci ga yawancin aikace-aikace da SQL injection shine baje a sabon lokaci da mai haɗi, masallaci PDO da cikakken horo na prepared statements shine daya daga cikin mahimman abu PHP mai yada ya dace ya fahimta — shi shine bambantarwa tsakanin aikace-aikace masu aminci da ɗaya mai bacewa ga lakarkarfin, ilimin sani na kullum. (Frameworks kamar Laravel suna amfani da PDO a ƙarƙata tare da builders/ORMs na masu aminci, amma ilimin farkace zai kasance.)