How can the PHP code be improved to enhance its functionality and security?

Issue: The PHP code is vulnerable to SQL injection attacks due to the use of concatenation in SQL queries. To enhance functionality and security, it is recommended to use prepared statements with parameterized queries. Code snippet with prepared statements: 

// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "database";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare a SQL statement with a parameterized query
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set the parameter values and execute the query
$username = "admin";
$stmt->execute();

// Get the result set
$result = $stmt->get_result();

// Fetch the data
while ($row = $result->fetch_assoc()) {
    // Process the data
}

// Close the statement and connection
$stmt->close();
$conn->close();

Keywords

SQL injection cross-site scripting prepared statements password hashing input validation

Related Questions