How do I safely insert user input into a SQL query in PHP?

Use PDO prepared statements and bound parameters instead of concatenating input into SQL. Parameters represent data values, not table or column names; allowlist any dynamic identifiers separately.

Reference: Official documentation.

AI-assisted DevCircle editorial answer. Corrections welcome.