Description:
The application directly embeds user-provided data from $_POST variables into SQL query strings without sanitization or parameterization. This allows an attacker to manipulate the query logic by inputting special SQL characters (like ', --, or ;), potentially leading to unauthorized data access, modification, or deletion.
Where the issue is: File: home.php.
Specific Code:
Inside the guestdetailsubmit block, the query for inserting reservations is built using raw variables: $sql = "INSERT INTO roombook(...) VALUES ('$Name','$Email','$Country',...)";.
How to fix it: Use Prepared Statements with bound parameters. This ensures that user input is treated strictly as data and not as executable code.
$stmt = $conn->prepare("INSERT INTO roombook(Name, Email, Country) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $Name, $Email, $Country);
$stmt->execute();
Note: While index.php contains a prepareAndExecute helper function, it is not utilized in home.php or other administrative files.
Description:
The application directly embeds user-provided data from $_POST variables into SQL query strings without sanitization or parameterization. This allows an attacker to manipulate the query logic by inputting special SQL characters (like ', --, or ;), potentially leading to unauthorized data access, modification, or deletion.
Where the issue is: File:
home.php.Specific Code:
Inside the
guestdetailsubmitblock, the query for inserting reservations is built using raw variables:$sql = "INSERT INTO roombook(...) VALUES ('$Name','$Email','$Country',...)";.How to fix it: Use Prepared Statements with bound parameters. This ensures that user input is treated strictly as data and not as executable code.
Note: While
index.phpcontains aprepareAndExecutehelper function, it is not utilized inhome.phpor other administrative files.