What potential security risks are present in the provided PHP script for user registration?

The provided PHP script for user registration is vulnerable to SQL injection attacks. This is because it directly inserts user input into SQL queries without proper sanitization. To mitigate this risk, we should use prepared statements with parameterized queries to prevent SQL injection attacks. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

// Vulnerable SQL query
$sql = "INSERT INTO users (username, password) VALUES ('$username', '$password')";

// Fixed code using prepared statements
$username = $_POST['username'];
$password = $_POST['password'];

$stmt = $pdo->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

Keywords

SQL injection cross-site scripting (XSS) password hashing input validation session management

Related Questions