Inurl Index.php%3fid= -

SELECT * FROM products WHERE product_id = $_GET['id']; The developer assumed that the id coming from the URL would always be a number. They did not "sanitize" the input.

For modern developers, seeing your site in this search result is a wake-up call. For security professionals, it is a reminder that old habits die hard. And for criminals? It is a list of potential victims. inurl index.php%3Fid=

$id = $_GET['id']; $stmt = $conn->prepare("SELECT * FROM users WHERE id = ?"); $stmt->bind_param("i", $id); // The "i" forces the input to be an integer. $stmt->execute(); Alternatively, if you cannot rewrite the backend, cast the variable to an integer: SELECT * FROM products WHERE product_id = $_GET['id'];