What potential security risks are present in the PHP code provided for managing categories and users?

The PHP code provided is vulnerable to SQL injection attacks due to the use of unsanitized user input in SQL queries. To mitigate this risk, it is important to use prepared statements with parameterized queries to prevent malicious input from being executed as SQL commands. 

// Original vulnerable code
$categoryName = $_POST['category_name'];
$sql = "INSERT INTO categories (name) VALUES ('$categoryName')";
$result = mysqli_query($conn, $sql);

// Fixed code using prepared statements
$categoryName = $_POST['category_name'];
$stmt = $conn->prepare("INSERT INTO categories (name) VALUES (?)");
$stmt->bind_param("s", $categoryName);
$stmt->execute();
$stmt->close();

Keywords

SQL injection Cross-site scripting (XSS) Input validation Password hashing Session hijacking

Related Questions