What are the potential security risks in the PHP code provided for the guestbook form?

The potential security risk in the PHP code provided for the guestbook form is the vulnerability to SQL injection attacks. To prevent this, we should use prepared statements with parameterized queries to sanitize user input before executing SQL queries. 

// Connect to database
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "guestbook";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Prepare SQL statement with placeholders
$stmt = $conn->prepare("INSERT INTO entries (name, message) VALUES (?, ?)");

// Bind parameters and execute SQL query
$stmt->bind_param("ss", $name, $message);

// Sanitize user input
$name = mysqli_real_escape_string($conn, $_POST['name']);
$message = mysqli_real_escape_string($conn, $_POST['message']);

// Execute prepared statement
$stmt->execute();

// Close statement and connection
$stmt->close();
$conn->close();

Keywords

SQL injection cross-site scripting (XSS) form validation input sanitization CSRF protection

Related Questions