Kepiye carane akses database kanthi aman nganggo PDO?

Question

Accepted Answer

**PDO** (PHP Data Objects) minangka antarmuka modern PHP sing database-agnostic kanggo akses database. Fitur sing paling penting yaiku **prepared statements**, sing mencegah **SQL injection** — praktik keamanan kritis kanggo code database apa pun.

## Sambung karo PDO

```php
<?php
$pdo = new PDO(
    "mysql:host=localhost;dbname=app;charset=utf8mb4",
    $username, $password,
    [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,    // throw exceptions on errors
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, // fetch rows as associative arrays
    ]
);
```

PDO bisa digunakake ing berbagai database (MySQL, PostgreSQL, SQLite, dll.) kanthi API sing sama. Nyetel `ERRMODE_EXCEPTION` nggawe error database bisa throw exception sing bisa ditangkap.

## Praktik kritis: prepared statements (mencegah SQL injection)

```php
// ❌ NEVER do this — concatenating user input → SQL INJECTION vulnerability
$result = $pdo->query("SELECT * FROM users WHERE id = " . $_GET['id']);
// input "1 OR 1=1" or "1; DROP TABLE users" → disaster

// ✅ ALWAYS use prepared statements with bound parameters
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ? AND active = ?");
$stmt->execute([$_GET['id'], true]);            // parameters bound SAFELY
$user = $stmt->fetch();

// named parameters work too
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email");
$stmt->execute(["email" => $email]);
```

**Prepared statements** ngirim SQL lan data kanthi terpisah — database memperlakukan parameter minangka data murni, ora kaya SQL sing bisa dieksekusi. Iki nggawe injection **mustahil**, sebisane input apa pun saka user. Iki ora bisa dinegosiasi kanggo query apa pun sing melibatkan input user.

## Ngambil hasil lan operasi liyane

```php
$stmt->fetch();         // one row (associative array)
$stmt->fetchAll();      // all rows
$stmt->fetchColumn();   // a single value

// INSERT/UPDATE/DELETE — also use prepared statements
$stmt = $pdo->prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->execute([$name, $email]);
$pdo->lastInsertId();   // the new row's ID
```

## Transaksi

```php
$pdo->beginTransaction();
try {
    $pdo->prepare("UPDATE accounts SET balance = balance - ? WHERE id = ?")->execute([$amt, $from]);
    $pdo->prepare("UPDATE accounts SET balance = balance + ? WHERE id = ?")->execute([$amt, $to]);
    $pdo->commit();          // all-or-nothing
} catch (Throwable $e) {
    $pdo->rollBack();         // undo on failure
}
```

## Ngapa iki penting

Akses database sing aman minangka salah siji aspek sing paling kritis keamanan ing pengembangan PHP, lan **PDO kanthi prepared statements minangka praktik penting** sing kudu dingerteni karo developer PHP apa pun.

SQL injection — disebabke dening concatenating untrusted user input langsung menyang query SQL — minangka salah siji vulnerability web sing paling umum lan merusak (ngidini penyerang kanggo baca, modifikasi, utawa musnahake data), lan iki bisa dicegah kanthi lengkap. **Prepared statements** kanthi bound parameters minangka solusi: kanthi ngirim struktur SQL lan data kanthi terpisah, database memperlakukan user input minangka data murni sing ora bisa dieksekusi minangka SQL, nggawe injection mustahil sebisane input apa pun.
"}}