## 3 Materials and Methods
### Methodology for User Authentication
The code constructs SQL queries by directly concatenating user-provided input, specifically the Susername and $password variables, into the SQL statement, without proper sanitization or parameterization. This opens the door to malicious exploitation, as an attacker could manipulate input to inject arbitrary SQL code, potentially compromising the security and integrity of the database.  
According to this, an attacker will attempt to manipulate the password field during the login process, by inputting the following syntax in the space to write the password during the login process of the web page (Figure 4).  
Then, the attacker will manipulate the SQL query by concatenating the username and password provided by the user directly into the query string, without proper sanitization. Here, the'OR 1 = 1 syntax is added to the password field. This part is designed to make the condition always true and the -- symbol is used to comment out the rest of the query, disabling any additional conditions that may follow. The resulting query might look something like that shown in Figure 5.  
Figure 4: SQL code for manipulating the password field during the login process.  
Figure 3: PHP code for authenticating users in a database, provided by ChatGPT.  
Since 1 = 1 is always true, the AND password = \" condition becomes irrelevant. The query effectively reduces to selecting all records from the user_table and the - symbol is used to comment out the rest of the query, to avoid syntax errors. This type of attack could lead to the deletion of records from the user_table, if the query were a DELETE type. Therefore, the attacker introduces the syntax \"DELETE FROM user_table WHERE'OR 1 = 1 -\" in the space where the password must be written during the login process of the web page.  
To obtain secure code that establishes a MySQL database, the user should have specified the following sentence at the prompt:  
* _\"Generate a secure PHP function to authenticate users using login credentials. The function should connect to a MySQL database and verify if the username and password match entries in the 'user_table' table. Ensure that the function is protected against SQL injection attacks by using prepared statements or parameterized queries. If the authentication is successful, the function should return the corresponding user ID. Otherwise, return -1\"._  
The main difference between the two prompts lies in the security approach. While the insecure prompt does not specify the need for protection against SQL injection attacks and does not mention the use of prepared statements or parameterized queries, the secure prompt explicitly emphasizes the importance of these measures to mitigate such risks. As a result, in the modified version, direct concatenation of the $username and $password values into the SQL query will be replaced with placeholders (?). Subsequently, prepared statements will be employed to bind the $username and $password values to these placeholders prior to query execution. This ensures that user input values will be treated as data and not as part of the SQL query structure, thereby mitigating the risk of SQL injection vulnerability. It is a classic example of SQL injection, emphasizing the importance of using prepared or parameterized queries to mitigate these vulnerabilities. To enhance security, it is recommended to use prepared statements or parameterized queries, which effectively mitigate the risk of SQL injection, by separating user input from the SQL code and ensuring proper escaping of values.