What potential security risks are present in the PHP code provided, and how can they be addressed?

The potential security risk present in the PHP code is the use of user input directly in a SQL query without proper sanitization, which can lead to SQL injection attacks. To address this issue, we should use prepared statements with parameterized queries to prevent SQL injection. 

// Original code with SQL injection vulnerability
$user_input = $_POST['user_input'];
$sql = "SELECT * FROM users WHERE username = '$user_input'";
$result = $conn->query($sql);

// Fixed code using prepared statements
$user_input = $_POST['user_input'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $user_input);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection cross-site scripting input validation password hashing secure coding practices

Related Questions