What are some common errors in the provided PHP code for fetching news entries from a database based on a link parameter?

One common error in the provided PHP code is the vulnerability to SQL injection due to directly concatenating the link parameter into the SQL query. To solve this, you should use prepared statements to prevent SQL injection attacks. Additionally, the code snippet should also handle cases where the link parameter is not provided or is invalid. 

<?php
// Check if link parameter is provided
if(isset($_GET['link'])) {
    $link = $_GET['link'];
    
    // Establish a database connection
    $conn = new mysqli("localhost", "username", "password", "database");

    // Prepare a SQL statement using a prepared statement
    $stmt = $conn->prepare("SELECT * FROM news WHERE link = ?");
    $stmt->bind_param("s", $link);
    $stmt->execute();

    // Fetch news entries based on the link parameter
    $result = $stmt->get_result();
    
    // Display news entries
    while($row = $result->fetch_assoc()) {
        echo $row['title'] . "<br>";
        echo $row['content'] . "<br>";
    }

    // Close the database connection
    $stmt->close();
    $conn->close();
} else {
    echo "Link parameter is missing or invalid.";
}
?>

Keywords

SQL injection PDO prepared statements error handling database connection.

Related Questions