Find the vulnerability in the code that reads data from a GET parameter

Reading data directly from a GET parameter without validation and filtering opens up vulnerabilities such as SQL injection, XSS, or other types of attacks, depending on how the data is used.

For example, if the code looks like this:

$userId = $_GET['user_id'];
$query = "SELECT * FROM users WHERE id = $userId";
$result = mysqli_query($conn, $query);

Here, an attacker can inject malicious SQL code into the user_id parameter, leading to database compromise.

To prevent this vulnerability:

• Use prepared statements with parameterization.
• Validate and filter input data (e.g., check that user_id is a number).

A safe example:

$userId = $_GET['user_id'];
if (!ctype_digit($userId)) {
    die('Invalid parameter');
}
$stmt = $conn->prepare('SELECT * FROM users WHERE id = ?');
$stmt->bind_param('i', $userId);
$stmt->execute();
$result = $stmt->get_result();

Thus, the vulnerability lies in the lack of input validation and filtering, which can lead to SQL injection and other attacks.