What are the potential risks of not properly sanitizing input data before inserting into a MySQL database using PHP?

When input data is not properly sanitized before inserting into a MySQL database using PHP, it leaves the application vulnerable to SQL injection attacks. This can lead to unauthorized access, data manipulation, and potentially the deletion of data in the database. To prevent this, it is important to sanitize input data by using prepared statements or escaping special characters before inserting it into the database. 

// Connect to MySQL database
$mysqli = new mysqli("localhost", "username", "password", "database");

// Sanitize input data before inserting into database
$name = $mysqli->real_escape_string($_POST['name']);
$email = $mysqli->real_escape_string($_POST['email']);

// Prepare SQL statement using prepared statements
$stmt = $mysqli->prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->bind_param("ss", $name, $email);

// Execute the statement
$stmt->execute();

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

SQL injection data validation prepared statements mysqli_real_escape_string security vulnerability

Related Questions