What is the issue with the current PHP code in the forum thread?

The issue with the current PHP code in the forum thread is that it is vulnerable to SQL injection attacks as it directly concatenates user input into the SQL query without proper sanitization. To solve this issue, we should use prepared statements with parameterized queries to prevent SQL injection attacks. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $sql);

// Fixed code using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection XSS vulnerability PDO prepared statements security vulnerability

Related Questions