What is the potential issue with the login function in the provided PHP code?

The potential issue with the login function in the provided PHP code is that it is vulnerable to SQL injection attacks. To solve this issue, you should use prepared statements with parameterized queries to prevent SQL injection. 

// Fix for login function using prepared statements
function login($username, $password) {
    $conn = new mysqli("localhost", "username", "password", "database");

    // Check connection
    if ($conn->connect_error) {
        die("Connection failed: " . $conn->connect_error);
    }

    $stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
    $stmt->bind_param("ss", $username, $password);

    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows > 0) {
        // User authenticated successfully
        return true;
    } else {
        // Authentication failed
        return false;
    }

    $stmt->close();
    $conn->close();
}

Keywords

SQL injection password hashing session management error handling secure coding practices

Related Questions