What are the potential security risks associated with using the provided login script in PHP?

The provided login script is vulnerable to SQL injection attacks as it directly concatenates user input into the SQL query. To mitigate this risk, you should use prepared statements with parameterized queries to securely handle user input. 

// Secure login script using prepared statements
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->execute(['username' => $username, 'password' => $password]);

if($stmt->rowCount() > 0) {
    // User authenticated
} else {
    // Invalid credentials
}

Keywords

SQL injection Cross-site scripting (XSS) Session hijacking Password hashing Input validation

Related Questions