What are the potential pitfalls of not properly validating user input in PHP, especially in a search functionality?

Not properly validating user input in PHP, especially in a search functionality, can lead to security vulnerabilities such as SQL injection attacks or cross-site scripting (XSS) attacks. To mitigate these risks, it is crucial to sanitize and validate user input before using it in any database queries or displaying it on the web page. 

// Example of validating user input in a search functionality
$searchTerm = isset($_GET['search']) ? $_GET['search'] : '';

// Sanitize the input to prevent SQL injection
$cleanSearchTerm = mysqli_real_escape_string($connection, $searchTerm);

// Validate the input to prevent XSS attacks
$cleanSearchTerm = htmlspecialchars($cleanSearchTerm);

// Use the sanitized and validated input in your database query
$query = "SELECT * FROM products WHERE name LIKE '%$cleanSearchTerm%'";
$result = mysqli_query($connection, $query);

Keywords

SQL injection cross-site scripting (XSS) data validation filter_input htmlentities

Related Questions