What potential security risks are present in the PHP code provided, such as SQL injection vulnerabilities?

The provided PHP code is vulnerable to SQL injection attacks because it directly inserts user input into the SQL query without proper sanitization. To mitigate this risk, you should use prepared statements with parameterized queries to prevent malicious SQL injection. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $query);

// Fixed code using prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection PHP code security risks vulnerabilities error types

Related Questions