What potential security vulnerabilities exist in the provided PHP code for managing entries in a database?

The provided PHP code is vulnerable to SQL injection attacks as it directly concatenates user input into the SQL query, making it possible for malicious users to manipulate the query. To prevent this vulnerability, it is recommended to use prepared statements with parameterized queries to sanitize user input and avoid SQL injection attacks. 

// Original vulnerable code
$query = "INSERT INTO entries (name, email) VALUES ('$name', '$email')";
$result = mysqli_query($connection, $query);

// Fixed code using prepared statements
$stmt = $connection->prepare("INSERT INTO entries (name, email) VALUES (?, ?)");
$stmt->bind_param("ss", $name, $email);
$stmt->execute();
$stmt->close();

Keywords

SQL injection input validation prepared statements cross-site scripting data sanitization

Related Questions