How can the SQL statement in the provided PHP code be improved to prevent SQL injection attacks?

To prevent SQL injection attacks, the SQL statement in the provided PHP code should use prepared statements with parameterized queries. This involves using placeholders for user input values that are then bound to parameters before execution, preventing malicious SQL code from being injected. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $sql);

// Improved code using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "ss", $username, $password);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Keywords

Prepared statements PDO bindParam SQL injection security

Related Questions