What is the issue with the SQL query in the provided PHP code?

The issue with the SQL query in the provided PHP code is that the table name is not properly concatenated with the variable $table_name. This can lead to SQL injection vulnerabilities. To solve this issue, you should use prepared statements to safely inject variables into the SQL query. 

// Issue: SQL injection vulnerability
// Original code:
// $sql = "SELECT * FROM $table_name WHERE id = $id";

// Fix: Use prepared statements to prevent SQL injection
$sql = "SELECT * FROM $table_name WHERE id = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();

// Process the result as needed

Keywords

SQL query PHP code syntax error database connection mysqli_fetch_assoc

Related Questions