What are the potential security vulnerabilities in the provided PHP login script, and how can they be addressed?

One potential security vulnerability in the provided PHP login script is the lack of input validation, which could lead to SQL injection attacks. To address this, we can use prepared statements with parameterized queries to prevent malicious SQL injection. 

// Validate user input and use prepared statements to prevent SQL injection
$username = $_POST['username'];
$password = $_POST['password'];

// Prepare a SQL statement using placeholders
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");

// Bind parameters to the placeholders
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);

// Execute the statement
$stmt->execute();

// Check if the user exists
if ($stmt->rowCount() > 0) {
    // User logged in successfully
} else {
    // Invalid username or password
}

Keywords

SQL injection password hashing session management cross-site scripting input validation

Related Questions