What are some potential pitfalls of directly inserting user input into SQL queries in PHP?

Directly inserting user input into SQL queries in PHP can lead to SQL injection attacks, where malicious users can manipulate the input to execute unauthorized SQL commands. To prevent this, it is important to use prepared statements with parameterized queries, which separate the SQL code from the user input. 

// Connect to the database
$pdo = new PDO('mysql:host=localhost;dbname=my_database', 'username', 'password');

// Prepare a statement with a parameterized query
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username');

// Bind the user input to the query parameters
$stmt->bindParam(':username', $_POST['username']);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection user input validation prepared statements PDO security vulnerabilities

Related Questions