In the provided PHP code snippet, what potential issue is present in the SQL query construction for retrieving data based on a user's email address?

The potential issue in the SQL query construction is that the email address input is directly concatenated into the query string, making it vulnerable to SQL injection attacks. To solve this issue, you should use prepared statements with parameterized queries to safely pass user input to the database. 

// Potential issue: SQL injection vulnerability
$email = $_GET['email'];
$query = "SELECT * FROM users WHERE email = '$email'";
```

```php
// Fix using prepared statements
$email = $_GET['email'];
$query = "SELECT * FROM users WHERE email = ?";
$stmt = $pdo->prepare($query);
$stmt->execute([$email]);

Keywords

PHP SQL injection prepared statements user input email address

Related Questions