What are the potential security risks associated with directly inserting user input into a database query in PHP?

Directly inserting user input into a database query in PHP can lead to SQL injection attacks, where malicious users can manipulate the query to access, modify, or delete data. To prevent this, it is important to sanitize and validate user input before including it in a query. 

// Sanitize and validate user input before including it in a query
$user_input = $_POST['user_input'];
$user_input = mysqli_real_escape_string($connection, $user_input); // Sanitize input
$user_input = filter_var($user_input, FILTER_SANITIZE_STRING); // Validate input

$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysqli_query($connection, $query);

Keywords

SQL injection user input validation prepared statements PDO data sanitization

Related Questions