What are the potential security risks when using $_GET[id] in SQL queries?

Using $_GET['id'] directly in SQL queries can lead to SQL injection attacks, where an attacker can manipulate the input to execute unauthorized SQL commands. To prevent this, you should always sanitize and validate user input before using it in SQL queries. One way to do this is by using prepared statements with parameterized queries. 

$id = $_GET['id'];
// Validate and sanitize the input
$id = filter_var($id, FILTER_SANITIZE_NUMBER_INT);

// Prepare a SQL statement using a prepared statement
$stmt = $pdo->prepare("SELECT * FROM table WHERE id = :id");
$stmt->bindParam(':id', $id, PDO::PARAM_INT);
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

$_GET SQL injection security risks data validation prepared statements

Related Questions