What are the potential risks of using addslashes in PHP for handling user input?

Using addslashes in PHP for handling user input can potentially lead to SQL injection vulnerabilities if not used correctly. It is recommended to use prepared statements with parameterized queries instead to prevent SQL injection attacks. Prepared statements separate SQL code from user input, making it safer to interact with the database. 

// Using prepared statements to handle user input safely
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a statement
$stmt = $mysqli->prepare("INSERT INTO users (username, email) VALUES (?, ?)");

// Bind parameters
$stmt->bind_param("ss", $username, $email);

// Set parameters and execute
$username = $_POST['username'];
$email = $_POST['email'];
$stmt->execute();

// Close statement and connection
$stmt->close();
$mysqli->close();

Keywords

addslashes PHP security SQL injection user input

Related Questions