What potential security risks are present in the code, especially in the SQL query?

The code is vulnerable to SQL injection attacks due to directly concatenating user input into the SQL query. To mitigate this risk, you should use prepared statements with parameterized queries to separate the SQL logic from the user input. 

// Original vulnerable code
$unsafe_variable = $_POST['user_input'];
$sql = "SELECT * FROM users WHERE username = '$unsafe_variable'";
$result = mysqli_query($conn, $sql);

// Fixed code using prepared statements
$unsafe_variable = $_POST['user_input'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $unsafe_variable);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection prepared statements PDO input validation escaping data

Related Questions