SQL built with variables (SQL injection)
Why it matters
Joining input into SQL lets an attacker rewrite the query itself and read, change or delete anything in the database. Prepared statements send the query and the values separately, so input can never become SQL.
$id = $_GET['id'];
$rows = $db->query("SELECT * FROM users WHERE id = $id");$stmt = $db->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$_GET['id']]);
$rows = $stmt->fetchAll();How to fix
Use prepared statements: $db->prepare('... WHERE id = ?') then execute([$id]).
Scan my code
Scan my code β
Paste a file and PHP Safe points to every line that matches this rule.