What potential security risks are involved in directly inserting data into a table without proper validation?

Directly inserting data into a table without proper validation can lead to SQL injection attacks, where malicious code is injected into the database query. To prevent this, always sanitize and validate user input before inserting it into the database. 

// Sanitize and validate user input before inserting into the database
$name = mysqli_real_escape_string($conn, $_POST['name']);
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);

// Insert sanitized data into the database
$sql = "INSERT INTO users (name, email) VALUES ('$name', '$email')";
$result = mysqli_query($conn, $sql);

if ($result) {
    echo "Data inserted successfully";
} else {
    echo "Error inserting data: " . mysqli_error($conn);
}

Keywords

SQL injection data sanitization prepared statements cross-site scripting input validation

Related Questions