What are the potential issues with the PHP code provided for displaying news articles?

The potential issue with the provided PHP code is that it is vulnerable to SQL injection attacks as it directly inserts user input into the SQL query without sanitization. To solve this issue, we should use prepared statements with parameterized queries to prevent SQL injection. 

// Original code vulnerable to SQL injection
$articleId = $_GET['id'];
$sql = "SELECT * FROM news_articles WHERE id = $articleId";
$result = $conn->query($sql);

// Fixed code using prepared statements
$articleId = $_GET['id'];
$stmt = $conn->prepare("SELECT * FROM news_articles WHERE id = ?");
$stmt->bind_param("i", $articleId);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection XSS vulnerability error handling database connection code optimization

Related Questions