PHP Database Pdo Connection Prepared Statements

Ringkasan

PDO (PHP Data Objects) adalah lapisan akses DB yang konsisten & aman. Prepared statement mencegah SQL injection.

Konsep Dasar

• DSN: string koneksi (mysql:host=...;dbname=...;charset=utf8mb4).
• new PDO($dsn, $user, $pass, $opts) di dalam try/catch.
• prepare() + execute([params]) → query aman.
• Placeholder ? (positional) atau :nama (named).

Cara Kerja / Struktur

php

try {
    $pdo = new PDO(
        "mysql:host=localhost;dbname=app;charset=utf8mb4",
        "user", "pass",
        [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]
    );
} catch (PDOException $e) {
    die("Koneksi gagal: " . $e->getMessage());
}
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

Catatan Implementasi

• Selalu set ERRMODE_EXCEPTION agar error jelas & bisa ditangkap.
• Jangan concat string ke SQL — selalu pakai placeholder.
• Contoh project nyata (CRUD lengkap) dibuat terpisah.

Kesalahan Umum

• Lupa charset=utf8mb4 → bug karakter (emoji/UTF-8).
• Menaruh credential di source (pakai env / dotenv).
• fetch() tanpa mode → default PDO::FETCH_BOTH (boros).

Glosarium

• DSN: Data Source Name, descriptor koneksi.
• Prepared statement: query prat-template, param dipisah.

Referensi

• PHP Keamanan Dasar
• PHP Environment & dotenv