What are the potential pitfalls of including a guestbook on a website using PHP?

One potential pitfall of including a guestbook on a website using PHP is the risk of SQL injection attacks if user input is not properly sanitized. To prevent this, always use prepared statements when interacting with a database to avoid SQL injection vulnerabilities. 

// Connect to the database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "guestbook";

$conn = new mysqli($servername, $username, $password, $dbname);

// Prepare a SQL statement using a prepared statement
$stmt = $conn->prepare("INSERT INTO entries (name, message) VALUES (?, ?)");
$stmt->bind_param("ss", $name, $message);

// Sanitize user input
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
$message = filter_var($_POST['message'], FILTER_SANITIZE_STRING);

// Execute the statement
$stmt->execute();

// Close the connection
$stmt->close();
$conn->close();

Keywords

SQL injection XSS attacks form validation data sanitization CSRF protection

Related Questions