PHP 8 · Web, security and database
Run a prepared statement
Pass values separately from the SQL, which prevents SQL injection.
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);
$user = $stmt->fetch();
Caution: Never build SQL by joining user input into the string.