How can SQL injection vulnerabilities be addressed in the PHP code snippet?

SQL injection vulnerabilities can be addressed in PHP code by using prepared statements with parameterized queries. This approach separates the SQL query from the user input, preventing malicious SQL code from being injected into the query. By binding parameters to the query, the database server can differentiate between the query and the user input, effectively preventing SQL injection attacks. 

// Original vulnerable code
$user_input = $_POST['username'];
$password = $_POST['password'];

// Vulnerable query
$sql = "SELECT * FROM users WHERE username='$user_input' AND password='$password'";

// Fixed code using prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE username=:username AND password=:password");
$stmt->bindParam(':username', $user_input);
$stmt->bindParam(':password', $password);
$stmt->execute();

Keywords

SQL injection PHP code vulnerability security prepared statements

Related Questions