What potential security risks are involved in not validating data before inserting it into a MySQL database in PHP?

Not validating data before inserting it into a MySQL database in PHP can lead to SQL injection attacks, where malicious code is inserted into the database query. To prevent this, always validate and sanitize user input before inserting it into the database. 

// Validate and sanitize user input before inserting into MySQL database
$name = $_POST['name'];
$email = $_POST['email'];

// Validate input
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    echo "Invalid email format";
    exit;
}

// Sanitize input
$name = mysqli_real_escape_string($conn, $name);
$email = mysqli_real_escape_string($conn, $email);

// Insert data into MySQL database
$sql = "INSERT INTO users (name, email) VALUES ('$name', '$email')";
mysqli_query($conn, $sql);

Keywords

SQL injection data validation prepared statements escaping input sanitization

Related Questions