What are the potential security risks associated with passing variables from a form directly into an SQL query in PHP?

Passing variables from a form directly into an SQL query in PHP can lead to SQL injection attacks, where malicious SQL code is inserted into the query, potentially giving attackers access to sensitive data or the ability to modify the database. To prevent this, it is important to sanitize and validate user input before using it in an SQL query. 

// Sanitize and validate user input before using it in an SQL query
$name = mysqli_real_escape_string($conn, $_POST['name']);
$email = mysqli_real_escape_string($conn, $_POST['email']);

// Prepare the SQL query using prepared statements
$stmt = $conn->prepare("INSERT INTO users (name, email) VALUES (?, ?)");
$stmt->bind_param("ss", $name, $email);
$stmt->execute();

Keywords

SQL injection form validation prepared statements parameterized queries data sanitization

Related Questions