What are the potential security risks in the provided PHP code snippet when interacting with a database?

The potential security risk in the provided PHP code snippet is SQL injection. To prevent this, you should use prepared statements with parameterized queries to sanitize user input before executing them in the database. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($connection, $query);

// Fixed code using prepared statements
$stmt = $connection->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);

$username = $_POST['username'];
$password = $_POST['password'];

$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection prepared statements PDO mysqli_real_escape_string data validation

Related Questions