Güvenli kod laboratuvarı

A profile page appends the user ID from the URL to the SQL text. Which change preserves the query structure?

// Hatalı örnek — çalıştırılmaz
$sql = 'SELECT * FROM users WHERE id = ' . $_GET['id'];

$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$userId]);

A comment is being printed directly into the HTML text node. Which approach is suitable for safe display?

// Hatalı örnek — çalıştırılmaz
echo '<p>' . $comment . '</p>';

echo '<p>' . htmlspecialchars($comment,
    ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . '</p>';

A logged in user fetches a record with document number. How do you prevent access to another user's document?

// Hatalı örnek — çalıştırılmaz
SELECT * FROM documents WHERE id = ?

SELECT * FROM documents
WHERE id = ? AND owner_id = ?
// owner_id: doğrulanmış oturumdan alınır.