In the given code snippet, what improvements can be made to enhance security and efficiency?

The code snippet provided is vulnerable to SQL injection attacks as it directly concatenates user input into the SQL query. To enhance security and efficiency, we should use prepared statements with parameterized queries to prevent SQL injection attacks. Prepared statements separate SQL code from user input, making it impossible for an attacker to inject malicious code. This also improves efficiency as the query execution plan is prepared once and reused for multiple executions. 

// Original code snippet vulnerable to SQL injection
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($connection, $query);

// Improved code snippet using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = mysqli_prepare($connection, $query);
mysqli_stmt_bind_param($stmt, "ss", $username, $password);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Keywords

SQL injection prepared statements password hashing input validation CSRF protection

Related Questions