What potential security risks are present in the code snippet provided, and how can they be mitigated?

The code snippet provided is vulnerable to SQL injection attacks due to directly interpolating user input into the SQL query. To mitigate this risk, you should use prepared statements with parameterized queries to safely handle user input. 

// Original vulnerable code snippet
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $sql);

// Mitigated code snippet using prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);

$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection cross-site scripting input validation prepared statements password hashing

Related Questions