What are some common mistakes made by PHP beginners when writing code, and how can they be avoided?

Common mistake: Not properly escaping user input, leaving the code vulnerable to SQL injection attacks. To avoid this, always use prepared statements when interacting with a database to sanitize input. 

// Incorrect way
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($connection, $query);

// Correct way
$username = mysqli_real_escape_string($connection, $_POST['username']);
$password = mysqli_real_escape_string($connection, $_POST['password']);
$query = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = mysqli_prepare($connection, $query);
mysqli_stmt_bind_param($stmt, "ss", $username, $password);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Keywords

syntax errors undefined variables incorrect function usage SQL injection security vulnerabilities

Related Questions