What are the security implications of directly passing user input (such as IDs) into SQL queries in PHP?

Directly passing user input into SQL queries in PHP can lead to SQL injection attacks, where malicious users can manipulate the input to execute unauthorized SQL commands. To prevent this, you should always use prepared statements with parameterized queries to sanitize and validate user input before executing the SQL query. 

// Using prepared statements to prevent SQL injection
$userId = $_POST['user_id'];

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
$stmt->bindParam(':id', $userId, PDO::PARAM_INT);
$stmt->execute();

// Fetch the result
$user = $stmt->fetch();

Keywords

SQL injection user input validation prepared statements PDO security vulnerabilities

Related Questions