How secure is the query in the provided PHP code snippet?

The provided PHP code snippet is vulnerable to SQL injection attacks because it directly inserts user input ($_GET['id']) into the SQL query without sanitizing it. To prevent SQL injection, you should use prepared statements with parameterized queries in PDO or MySQLi. 

// Connect to the database
$pdo = new PDO("mysql:host=localhost;dbname=mydatabase", "username", "password");

// Prepare a statement
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");

// Bind the parameter
$stmt->bindParam(':id', $_GET['id']);

// Execute the query
$stmt->execute();

// Fetch the result
$user = $stmt->fetch();

Keywords

SQL injection prepared statements PDO data sanitization security vulnerabilities

Related Questions