What are the potential consequences of not sanitizing user input in a PHP script that interacts with a MySQL database?

If user input is not sanitized in a PHP script that interacts with a MySQL database, it can lead to SQL injection attacks where malicious code is injected into the database queries. This can result in unauthorized access to the database, data manipulation, and potentially the deletion of data. To prevent this, it is crucial to sanitize user input before using it in database queries. 

// Sanitize user input before using it in a MySQL query
$userInput = $_POST['user_input'];
$sanitizedInput = mysqli_real_escape_string($connection, $userInput);

// Use the sanitized input in the query
$query = "SELECT * FROM table WHERE column = '$sanitizedInput'";
$result = mysqli_query($connection, $query);

// Rest of the code to process the query result

Keywords

SQL injection security vulnerability mysqli_real_escape_string prepared statements data breach

Related Questions