What are the potential security risks of directly inserting values into SQL queries in PHP?

Directly inserting values into SQL queries in PHP can lead to SQL injection attacks, where malicious SQL code is inserted into the query. This can allow attackers to manipulate the database, steal data, or perform other unauthorized actions. To prevent this, you should always use prepared statements with parameterized queries to securely handle user input. 

// Using prepared statements to prevent SQL injection
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a SQL query using a placeholder for the user input
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set the user input and execute the query
$username = $_POST['username'];
$stmt->execute();

// Get the results
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
    // Process the results
}

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

SQL injection prepared statements PDO mysqli_real_escape_string data validation

Related Questions