What are some potential security vulnerabilities in the provided PHP script, such as SQL injection, and how can they be mitigated?

One potential security vulnerability in the provided PHP script is SQL injection, where an attacker can manipulate input data to execute malicious SQL queries. To mitigate this vulnerability, you should use prepared statements with parameterized queries instead of directly concatenating user input into SQL queries. Example of mitigating SQL injection vulnerability using prepared statements: 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = $conn->query($sql);

// Mitigated code using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection security vulnerabilities PHP script mitigated PHP functions

Related Questions