What potential security risks are present in the provided PHP code for inserting values into a SQL database?

The provided PHP code is vulnerable to SQL injection attacks because it directly inserts user input into the SQL query without sanitizing it. To mitigate this risk, you should use prepared statements with parameterized queries to prevent malicious SQL injection. 

// Fix for preventing SQL injection using prepared statements

// Assuming $conn is the database connection object

// User input
$name = $_POST['name'];
$email = $_POST['email'];

// Prepare the SQL statement with placeholders
$stmt = $conn->prepare("INSERT INTO users (name, email) VALUES (?, ?)");

// Bind parameters to the placeholders
$stmt->bind_param("ss", $name, $email);

// Execute the statement
$stmt->execute();

// Close the statement and database connection
$stmt->close();
$conn->close();

Keywords

SQL injection prepared statements mysqli_real_escape_string input validation cross-site scripting

Related Questions