Why this matters
Concatenating user input into SQL queries can allow an attacker to inject malicious commands into the database. Prepared statements ensure that data is treated as parameters, preventing unexpected SQL code execution.
Do not build SQL queries by directly concatenating untrusted data. Instead, use prepared statements with parameters (for example, using PDO or MySQLi) to prevent SQL Injection.
Concatenating user input into SQL queries can allow an attacker to inject malicious commands into the database. Prepared statements ensure that data is treated as parameters, preventing unexpected SQL code execution.
Side-by-side examples engineers can pattern-match during review.
<?php
$nome = $_GET['nome'];
$query = "SELECT * FROM usuarios WHERE nome = '$nome'";
$result = mysqli_query($conn, $query);
?><?php
$nome = $_GET['nome'];
$stmt = $pdo->prepare("SELECT * FROM usuarios WHERE nome = :nome");
$stmt->execute(['nome' => $nome]);
$usuarios = $stmt->fetchAll();
?><?php
$nome = $_GET['nome'];
$query = "SELECT * FROM usuarios WHERE nome = '$nome'";
$result = mysqli_query($conn, $query);
?><?php
$nome = $_GET['nome'];
$stmt = $pdo->prepare("SELECT * FROM usuarios WHERE nome = :nome");
$stmt->execute(['nome' => $nome]);
$usuarios = $stmt->fetchAll();
?>From the same buckets as this rule.