What is the potential issue with the PHP code provided for fetching data from a database and displaying it using echo?

The potential issue with the provided PHP code is that it is vulnerable to SQL injection attacks. To solve this issue, it is recommended to use prepared statements with parameterized queries to prevent malicious SQL injection. 

// Connect to the database
$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'username', 'password');

// Prepare a statement with a parameterized query
$stmt = $pdo->prepare("SELECT * FROM mytable WHERE id = :id");

// Bind the parameter
$stmt->bindParam(':id', $id);

// Execute the query
$stmt->execute();

// Fetch and display the data
while ($row = $stmt->fetch()) {
    echo $row['column1'] . ' - ' . $row['column2'] . '<br>';
}

Keywords

SQL injection mysqli_real_escape_string prepared statements XSS vulnerability error handling

Related Questions