SQL injection (ARCH7100)

Key php.security.sql-injection · Severity error · Category security · CWE CWE-89

Building a SQL query by concatenating user input lets attackers alter the query structure, bypass authentication, or exfiltrate entire tables. Parameterized queries always treat input as data.

Incorrect

<?php
$pdo = new PDO($dsn, $user, $pass);
$email = $_GET['email'];
$stmt = $pdo->query("SELECT * FROM users WHERE email = '$email'");
$row = $stmt->fetch();

Correct

<?php
$pdo = new PDO($dsn, $user, $pass);
$email = $_GET['email'];
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?');
$stmt->execute([$email]);
$row = $stmt->fetch();

Fix

Build queries with prepared statements and bound parameters; never concatenate user input into SQL text.