What are the potential security risks associated with using GET parameters in SQL queries in PHP?

Using GET parameters directly in SQL queries in PHP can make your application vulnerable to SQL injection attacks, where an attacker can manipulate the input to execute malicious SQL commands. To prevent this, you should always sanitize and validate user input before using it in SQL queries. One way to do this is by using prepared statements with parameterized queries, which separate the SQL code from the user input. 

// Example of using prepared statements to prevent SQL injection
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Sanitize and validate the GET parameter
$id = filter_var($_GET['id'], FILTER_SANITIZE_NUMBER_INT);

// Prepare the SQL query with a placeholder for the parameter
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');

// Bind the sanitized parameter to the placeholder
$stmt->bindParam(':id', $id, PDO::PARAM_INT);

// Execute the query
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll(PDO::FETCH_ASSOC);

// Loop through the results
foreach ($results as $row) {
    // Output the data
    echo $row['username'] . '<br>';
}

Keywords

SQL injection GET parameters security risks PHP data validation

Related Questions