PDO with prepared statements is the modern API—never concatenate user input into SQL on PHP apps.
Prepared statement
prepare('SELECT id, name FROM products WHERE price < ?');
$stmt->execute([10]);
foreach ($stmt as $row) { /* ... */ }Practice: Review in local or staging only.
Error mode
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
Important interview questions and answers
- Q: PDO vs mysqli?
A: PDO supports multiple DB drivers and named parameters style. - Q: SQL injection?
A: Prepared statements bind user data separately from SQL text.
Self-check
- Why ATTR_ERRMODE EXCEPTION?
- How bind price parameter?
Tip: PDO prepared statements for all user input.
Interview prep
- Prepared statements?
Separate SQL structure from user data—stops injection.
- ERRMODE_EXCEPTION?
Surfaces DB errors as exceptions.