What potential security risks are present in the provided PHP code?

The provided PHP code is vulnerable to SQL injection attacks due to the use of unsanitized user input in the SQL query. To mitigate this risk, we should use prepared statements with parameterized queries to prevent malicious SQL injection attempts. 

// Original vulnerable code
$user_input = $_POST['username'];
$query = "SELECT * FROM users WHERE username = '$user_input'";
$result = mysqli_query($conn, $query);

// Fixed code using prepared statements
$user_input = $_POST['username'];
$query = "SELECT * FROM users WHERE username = ?";
$stmt = $conn->prepare($query);
$stmt->bind_param("s", $user_input);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection cross-site scripting input validation password hashing secure file uploads

Related Questions