SQL injection, insertion

SQL injection is an attack where malicious code is passed to an SQL Server for execution. The attack can result in unauthorized access to confidential data, or destruction of critical data.

Before you try to read the methods below, realize that this should only be a concern for PHP developers and the like. If you are using a database driven program (e.g. WordPress, Joomla, OSCommerce), then all you need to do is upgrade your programs to the latest version available.

Methods to prevent SQL injection

Escaping

One way to prevent injections is to escape dangerous characters (i.e. backslash, apostrophe and semicolon). In PHP, it is typical to escape the input using the function mysql_real_escape_string before sending the SQL query. Example:

$Uname = mysql_real_escape_string($Uname);
$Pword = mysql_real_escape_string($Pword);
$query = "SELECT * FROM Users where UserName='$Uname' and Password='$Pword'";
mysql_query($query);

 

Parameterized statements

A parameterized query uses placeholders for the input, and the parameter values are supplied at execution time.

$params = array($Uname, $Pword);
$sql = 'INSERT INTO Users (UserName, Password) VALUES (?, ?)';
$query = sqlsrv_query($connection, $sql, $params);

 

Advanced: In PHP version 5 and above, there are multiple choices for using parameterized statements; the PDO database layer is one of them. There are also vendor-specific methods; for example, MySQL 4.1 + used with the mysqli extension.

  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

50,000 inodes limit

An inode is a data structure used to keep information about a file on your hosting account. The...

CPU resource usage

GoMedia allows a maximum of 25% CPU usage limit. You may exceed this limit for no longer than 90...

How can I make a stronger password?

It is important to have a password that is easy to remember, but hard to guess.Hackers can guess...

How can I prevent hacking?

1. The most important thing to do is keep your passwords a secret. If you must give a password to...

How to handle the Google Attack Page

When you see the dreaded Google attack site warning, you should immediately email...