What potential security vulnerability is highlighted in the discussion regarding the provided PHP code?

The potential security vulnerability highlighted in the provided PHP code is SQL injection. This vulnerability arises from directly concatenating user input into SQL queries, making it possible for malicious users to manipulate the query to execute unintended commands on the database. To prevent SQL injection, it is recommended to use prepared statements with parameterized queries. 

// Fix for preventing SQL injection using prepared statements
$pdo = new PDO('mysql:host=localhost;dbname=myDB', 'username', 'password');
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

Keywords

SQL injection user input validation prepared statements security vulnerability data sanitization

Related Questions