What potential issue is highlighted in the PHP code related to checking if a username already exists in the database?

The potential issue highlighted in the PHP code related to checking if a username already exists in the database is that it is vulnerable to SQL injection attacks. This is because the code directly concatenates user input into the SQL query, making it possible for malicious users to manipulate the query. To solve this issue, you should use prepared statements with parameterized queries to prevent SQL injection attacks. 

// Fix for checking if a username already exists in the database using prepared statements

$username = $_POST['username'];

// Prepare a SQL statement
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->execute(['username' => $username]);

// Check if the username exists in the database
if($stmt->rowCount() > 0) {
    echo "Username already exists";
} else {
    echo "Username is available";
}

Keywords

SQL injection prepared statements mysqli query execution data validation

Related Questions