What potential security risks are present in the MySQL queries used in the code?

The potential security risk present in the MySQL queries used in the code is SQL injection. This vulnerability allows attackers to manipulate the SQL queries by injecting malicious code, potentially leading to unauthorized access to the database or data leakage. To prevent SQL injection, it is recommended to use parameterized queries or prepared statements with bound parameters. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $sql);

// Fixed code using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username=? AND password=?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection prepared statements mysqli_real_escape_string PDO data validation

Related Questions