What is the potential issue with the SQL syntax in the provided PHP code?

The potential issue with the SQL syntax in the provided PHP code is that the variables $username and $password are being directly concatenated into the SQL query, making it vulnerable to SQL injection attacks. To solve this issue, you should use prepared statements with parameterized queries to securely pass user input to the database. 

// Fix for the SQL syntax issue using prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->execute(array(':username' => $username, ':password' => $password));

Keywords

SQL syntax PHP code potential issue error query execution

Related Questions