How can SQL injection vulnerabilities be prevented in PHP code like the one provided in the forum thread?

SQL injection vulnerabilities can be prevented in PHP code by using prepared statements with parameterized queries. This approach ensures that user input is treated as data rather than executable code, thus preventing malicious SQL injection attacks. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($connection, $query);

// Fixed code using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = mysqli_prepare($connection, $query);
mysqli_stmt_bind_param($stmt, "ss", $username, $password);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Keywords

SQL injection prepared statements PDO input validation parameterized queries

Related Questions