What are the potential pitfalls of directly inserting user input into SQL queries without proper sanitization in PHP?

Directly inserting user input into SQL queries without proper sanitization can lead to SQL injection attacks, where malicious users can manipulate the query to access, modify, or delete data in the database. To prevent this, always use prepared statements with parameterized queries in PHP to sanitize user input and prevent SQL injection attacks. 

// Using prepared statements to sanitize user input in PHP
$pdo = new PDO('mysql:host=localhost;dbname=database', 'username', 'password');

// User input
$userInput = $_POST['user_input'];

// Prepare a SQL query with a placeholder
$stmt = $pdo->prepare("SELECT * FROM table WHERE column = :userInput");

// Bind the user input to the placeholder
$stmt->bindParam(':userInput', $userInput);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection user input sanitization prepared statements security vulnerability

Related Questions