What security vulnerability does the initial PHP code snippet pose?

The initial PHP code snippet poses a security vulnerability known as SQL injection. This vulnerability allows attackers to manipulate database queries by injecting malicious SQL code into input fields. To prevent SQL injection, it is important to use prepared statements with parameterized queries in PHP. 

// Fix for SQL injection vulnerability using prepared statements
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username AND password = :password");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

Keywords

SQL injection user input validation prepared statements security vulnerability PHP code snippet

Related Questions