What potential security issue is present in the provided PHP code snippet?

The potential security issue in the provided PHP code snippet is the use of user input directly in a SQL query without proper sanitization. This leaves the code vulnerable to SQL injection attacks, where malicious users can manipulate the query to perform unauthorized actions on the database. To solve this issue, you should use prepared statements with parameterized queries to safely handle user input. 

// Original code snippet with security issue
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $query);

// Fixed code snippet using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username = ? AND password = ?";
$stmt = $conn->prepare($query);
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection user input prepared statements security vulnerability data sanitization

Related Questions