php 43 lines · 7 steps

A safe PDO user repository in PHP

A repository class wraps PDO with prepared statements to fetch users without exposing SQL injection risks.

Explained by highlit

Intermediate prepared-statements repository-pattern sql-injection dependency-injection

1<?php
2 
3final class UserRepository
4{
  public function __construct(private PDO $pdo)
  {
  }
8 
  public function findByEmail(string $email): ?array
  {
      $stmt = $this->pdo->prepare(
          'SELECT id, email, display_name, created_at
           FROM users
           WHERE email = :email
           LIMIT 1'
      );
17 
      $stmt->bindValue(':email', $email, PDO::PARAM_STR);
      $stmt->execute();
20 
      $user = $stmt->fetch(PDO::FETCH_ASSOC);
22 
      return $user === false ? null : $user;
  }
25 
  public function searchActive(string $term, int $limit): array
  {
      $stmt = $this->pdo->prepare(
          'SELECT id, email, display_name
           FROM users
           WHERE is_active = 1
             AND display_name LIKE :term
           ORDER BY display_name ASC
           LIMIT :limit'
      );
36 
      $stmt->bindValue(':term', '%' . $term . '%', PDO::PARAM_STR);
      $stmt->bindValue(':limit', $limit, PDO::PARAM_INT);
      $stmt->execute();
40 
      return $stmt->fetchAll(PDO::FETCH_ASSOC);
  }
43}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Prepared statements with bound parameters keep user input out of the SQL text, closing off injection.
2Injecting the PDO connection lets the repository stay testable and agnostic about connection setup.
3Binding with the right PDO type — PARAM_INT for LIMIT, PARAM_STR for text — avoids subtle query bugs.

Related explainers

typescript

import { registerLocaleData } from '@angular/common';
import localeFr from '@angular/common/locales/fr';
import localeFrExtra from '@angular/common/locales/extra/fr';
import localeDe from '@angular/common/locales/de';

Locale-aware bootstrapping in Angular

i18n localization dependency-injection

Intermediate 8 steps

php

<?php
 
class NameParser
{

Parsing a full name into components in PHP

string-parsing arrays normalization

Intermediate 8 steps

typescript

import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import * as Joi from 'joi';

Validating env config at boot in NestJS

configuration schema-validation environment-variables

Intermediate 8 steps

php

<?php
 
namespace App\Services\Checkout;

Validating coupons with Laravel's Pipeline

pipeline chain of responsibility transactions

Intermediate 7 steps

java

@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {

Transparent column encryption in Spring & JPA

encryption aes-gcm jpa-converter

Advanced 10 steps

typescript

import { Inject, Injectable, Logger } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';
import { InjectRepository } from '@nestjs/typeorm';