Readability matters
SQL dumped from ORMs, query builders, or logs is often a single long line. Formatting makes it possible to read, debug, and review queries — especially complex ones with multiple JOINs.
PDO and prepared statements
Always use PDO prepared statements — $pdo->prepare($sql) with bound parameters. Never concatenate user input directly into SQL strings regardless of escaping.
EXPLAIN your queries
Paste a formatted query into MySQL with EXPLAIN SELECT ... to see the execution plan. Look for full table scans (type=ALL) and missing indexes.
SQL injection
SQL injection is still the most common web vulnerability. Use prepared statements, never build queries with string concatenation using user data, and use an ORM if possible.
PDO, query optimization, database design, and ORM patterns — covered in our PHP developer ebooks and courses.