In the provided PHP script, what potential pitfalls or best practices can be identified?

The provided PHP script is vulnerable to SQL injection attacks as it directly concatenates user input into the SQL query without sanitization. To prevent this, it is recommended to use prepared statements with parameterized queries to securely interact with the database. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

// Fixed code using prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);

$username = $_POST['username'];
$password = $_POST['password'];

$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection XSS vulnerability error handling secure coding code optimization

Related Questions