What potential security risks are present in the PHP code provided for updating user information in a MySQL database?

The provided PHP code is vulnerable to SQL injection attacks as it directly inserts user input into the SQL query without proper sanitization. To mitigate this risk, we should use prepared statements with parameterized queries to securely update user information in the MySQL database. 

// Original vulnerable code
$user_id = $_POST['user_id'];
$new_email = $_POST['new_email'];

// Vulnerable to SQL injection
$sql = "UPDATE users SET email = '$new_email' WHERE id = $user_id";
$result = mysqli_query($conn, $sql);

// Fixed code using prepared statements
$user_id = $_POST['user_id'];
$new_email = $_POST['new_email'];

$stmt = $conn->prepare("UPDATE users SET email = ? WHERE id = ?");
$stmt->bind_param("si", $new_email, $user_id);
$stmt->execute();
$stmt->close();

Keywords

SQL injection Cross-site scripting (XSS) Input validation Prepared statements Escaping data

Related Questions