What are some potential design flaws in the PHP code provided for updating database records?

One potential design flaw in the provided PHP code for updating database records is the lack of prepared statements, which leaves the code vulnerable to SQL injection attacks. To solve this issue, you should use prepared statements to safely pass user input to the database. 

// Original code without prepared statements
$id = $_POST['id'];
$name = $_POST['name'];
$age = $_POST['age'];

$query = "UPDATE users SET name='$name', age='$age' WHERE id='$id'";
mysqli_query($conn, $query);

// Updated code with prepared statements
$id = $_POST['id'];
$name = $_POST['name'];
$age = $_POST['age'];

$stmt = $conn->prepare("UPDATE users SET name=?, age=? WHERE id=?");
$stmt->bind_param("ssi", $name, $age, $id);
$stmt->execute();

Keywords

SQL injection data validation prepared statements error handling database transactions

Related Questions