What potential security risks are present in the PHP code snippet provided, especially in terms of exposing sensitive information like passwords?

The potential security risk in the provided PHP code snippet is that it is directly accessing the database with hard-coded credentials, which can expose sensitive information like passwords. To solve this issue, it is recommended to store the database credentials in a separate configuration file outside of the web root directory and include this file in the PHP script. 

// config.php
<?php
$host = 'localhost';
$username = 'your_username';
$password = 'your_password';
$database = 'your_database';
?>

// index.php
<?php
include 'config.php';

$conn = new mysqli($host, $username, $password, $database);

// Rest of the PHP code
?>

Keywords

SQL injection password hashing secure coding practices environment variables sensitive data exposure

Related Questions