How can User-Agent and Referer headers be manipulated to exploit SQL injection vulnerabilities in PHP?

User-Agent and Referer headers can be manipulated by attackers to inject malicious SQL queries into PHP applications. To prevent this, developers should always sanitize and validate input data, especially when it comes from user-controlled sources like headers. By using prepared statements and parameterized queries, developers can protect their applications from SQL injection attacks.

// Sanitize and validate User-Agent header
$userAgent = filter_input(INPUT_SERVER, 'HTTP_USER_AGENT', FILTER_SANITIZE_STRING);

// Sanitize and validate Referer header
$referer = filter_input(INPUT_SERVER, 'HTTP_REFERER', FILTER_SANITIZE_URL);