What potential issue could arise from directly using user input in a SQL query like in the code snippet?

The potential issue that could arise from directly using user input in a SQL query is SQL injection. This is a security vulnerability where an attacker can manipulate user input to execute malicious SQL commands. To prevent SQL injection, you should use prepared statements with parameterized queries to safely handle user input. 

// Fix for preventing SQL injection using prepared statements
$user_input = $_POST['user_input'];

// Prepare a SQL statement with a parameter
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");

// Bind the parameter with the user input
$stmt->bindParam(':username', $user_input);

// Execute the statement
$stmt->execute();

// Fetch the results
$results = $stmt->fetchAll();

Keywords

SQL injection user input validation prepared statements PDO security vulnerability

Related Questions