What are the potential pitfalls of using mysql_query in PHP for ordering results?

Using mysql_query in PHP for ordering results can potentially lead to SQL injection vulnerabilities if user input is not properly sanitized. To avoid this, it is recommended to use parameterized queries or prepared statements instead. This helps prevent malicious SQL code from being injected into the query. 

// Example of using prepared statements to order results in PHP
$mysqli = new mysqli("localhost", "username", "password", "database");

if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

$stmt = $mysqli->prepare("SELECT * FROM table_name ORDER BY column_name DESC");
$stmt->execute();
$result = $stmt->get_result();

while ($row = $result->fetch_assoc()) {
    // Process each row
}

$stmt->close();
$mysqli->close();

Keywords

mysql_query ordering results SQL injection deprecated function security vulnerability

Related Questions