What modifications were made to the original code to improve functionality and why?

The original code had a vulnerability to SQL injection attacks due to directly inserting user input into the SQL query. To improve functionality and security, the code was modified to use prepared statements with parameterized queries. This prevents malicious users from injecting SQL code into the query. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($connection, $query);

// Modified code using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = mysqli_prepare($connection, $query);
mysqli_stmt_bind_param($stmt, "ss", $username, $password);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

Keywords

modifications code improve functionality PHP functions libraries

Related Questions