Can UNION injections be executed in PHP applications using mysqli_query?

UNION injections can be executed in PHP applications using mysqli_query if user input is not properly sanitized. To prevent this, always use prepared statements with bound parameters to safely execute queries and avoid SQL injection attacks. 

// Example of using prepared statements to prevent UNION injections
$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

$username = $_POST['username'];
$stmt->execute();

$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    // Process the retrieved data
}

$stmt->close();
$conn->close();

Keywords

UNION injections PHP applications mysqli_query security vulnerability SQL injection

Related Questions