What are the potential pitfalls of using PHP to dynamically sort a table based on user input?

One potential pitfall of using PHP to dynamically sort a table based on user input is the risk of SQL injection if user input is not properly sanitized. To mitigate this risk, always use prepared statements or parameterized queries when interacting with a database in PHP. 

// Example of using prepared statements to dynamically sort a table based on user input

// Assuming $conn is a valid database connection

// Get user input for sorting
$sortColumn = $_GET['sortColumn'];
$sortOrder = $_GET['sortOrder'];

// Prepare a statement with placeholders for user input
$stmt = $conn->prepare("SELECT * FROM table_name ORDER BY $sortColumn $sortOrder");

// Bind any necessary parameters
$stmt->bindParam(':sortColumn', $sortColumn);
$stmt->bindParam(':sortOrder', $sortOrder);

// Execute the statement
$stmt->execute();

// Fetch and display the sorted data
while ($row = $stmt->fetch()) {
    // Display data here
}

Keywords

SQL injection XSS attacks user input validation sorting algorithms security vulnerabilities

Related Questions