What potential security issue is present in the provided PHP code?

The potential security issue in the provided PHP code is the use of user input directly in a SQL query without proper sanitization, which can lead to SQL injection attacks. To solve this issue, you should use prepared statements with parameterized queries to separate the SQL logic from the data input. 

// Original code with SQL injection vulnerability
$user_input = $_POST['username'];
$sql = "SELECT * FROM users WHERE username = '$user_input'";
$result = $conn->query($sql);

// Fixed code using prepared statements
$user_input = $_POST['username'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $user_input);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection input validation prepared statements htmlspecialchars cross-site scripting

Related Questions