What is the main issue with the Searchsystem in the PHP code provided?

The main issue with the Searchsystem in the provided PHP code is that it is vulnerable to SQL injection attacks. To solve this issue, you should use prepared statements with parameterized queries to prevent malicious users from injecting SQL code into the search input. 

// Original vulnerable code
$search_query = $_GET['query'];
$sql = "SELECT * FROM products WHERE name LIKE '%$search_query%'";
$result = mysqli_query($conn, $sql);

// Fixed code using prepared statements
$search_query = $_GET['query'];
$sql = "SELECT * FROM products WHERE name LIKE ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("s", $search_query);
$stmt->execute();
$result = $stmt->get_result();

Keywords

Searchsystem PHP code issue error types libraries

Related Questions