How can the code provided be improved in terms of security measures?

The code provided is vulnerable to SQL injection attacks due to directly concatenating user input into the SQL query. To improve security, we should use prepared statements with parameterized queries to prevent SQL injection. 

// Improved code with prepared statements for security
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare a SQL statement
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);

// Set parameters and execute
$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();

echo "New records created successfully";

$stmt->close();
$conn->close();

Keywords

SQL injection cross-site scripting password hashing input validation prepared statements

Related Questions