What are the security risks associated with directly using user input in MySQL queries in PHP?

When directly using user input in MySQL queries in PHP, there is a risk of SQL injection attacks where malicious users can manipulate the input to execute unauthorized SQL commands. To prevent this, it is essential to use prepared statements with parameterized queries in PHP to sanitize and validate user input before executing the query. 

// Using prepared statements to prevent SQL injection
$mysqli = new mysqli("localhost", "username", "password", "database");

// Check connection
if ($mysqli->connect_error) {
    die("Connection failed: " . $mysqli->connect_error);
}

// Prepare a query with a parameter
$stmt = $mysqli->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set the user input
$username = $_POST['username'];

// Execute the query
$stmt->execute();
$result = $stmt->get_result();

// Process the result
while ($row = $result->fetch_assoc()) {
    // Handle the fetched data
}

// Close the statement and connection
$stmt->close();
$mysqli->close();

Keywords

SQL injection user input validation prepared statements mysqli_real_escape_string PDO.

Related Questions