What potential security risks are present in the current PHP script, and how can they be mitigated?

The current PHP script is vulnerable to SQL injection attacks as it directly concatenates user input into the SQL query. To mitigate this risk, you should use prepared statements with parameterized queries to prevent malicious SQL injection. 

// Original vulnerable code
$user_input = $_POST['username'];
$query = "SELECT * FROM users WHERE username='$user_input'";
$result = mysqli_query($connection, $query);

// Mitigated code using prepared statements
$user_input = $_POST['username'];
$query = "SELECT * FROM users WHERE username=?";
$stmt = $connection->prepare($query);
$stmt->bind_param("s", $user_input);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection Cross-site scripting (XSS) Input validation Escaping output Secure coding practices

Related Questions