What are some potential issues with the PHP code provided for a guestbook, and how can they be addressed?

Issue: The PHP code does not sanitize user input, leaving the application vulnerable to SQL injection attacks. To address this issue, you can use prepared statements with parameterized queries to sanitize user input before executing SQL queries. 

// Connect to the database
$pdo = new PDO('mysql:host=localhost;dbname=guestbook', 'username', 'password');

// Prepare a SQL query using a parameterized query
$stmt = $pdo->prepare('INSERT INTO entries (name, message) VALUES (:name, :message)');
$stmt->bindParam(':name', $_POST['name']);
$stmt->bindParam(':message', $_POST['message']);

// Execute the query
$stmt->execute();

Keywords

SQL injection XSS vulnerability input validation error handling prepared statements

Related Questions