What is the potential issue with the SQL query in the provided PHP code?

The potential issue with the SQL query in the provided PHP code is SQL injection vulnerability. The code directly concatenates user input ($_GET['id']) into the SQL query without sanitization, which can allow malicious users to manipulate the query. To solve this issue, you should use prepared statements with parameterized queries to prevent SQL injection attacks. This way, user input will be treated as data rather than executable SQL code. 

// Fix for SQL injection vulnerability using prepared statements
$id = $_GET['id'];
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");
$stmt->bindParam(':id', $id);
$stmt->execute();

Keywords

SQL injection prepared statements mysqli_real_escape_string vulnerability data sanitization

Related Questions