What are the potential security risks of using "profile.php?id=11" for public user profiles in PHP?

Using "profile.php?id=11" for public user profiles in PHP can pose security risks such as SQL injection attacks. To mitigate this risk, it is important to sanitize and validate the input received from the URL parameter before using it in database queries. Implementing parameterized queries or using prepared statements can help prevent SQL injection attacks. 

// Sanitize and validate the input received from the URL parameter
$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);

if($id !== false) {
    // Use parameterized queries or prepared statements to prevent SQL injection
    $stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();
    
    // Fetch user profile data
    $userProfile = $stmt->fetch(PDO::FETCH_ASSOC);
    
    // Display user profile data
    // ...
} else {
    // Handle invalid input
    echo "Invalid user ID";
}

Keywords

SQL injection user input validation cross-site scripting data sanitization secure coding practices

Related Questions