Welcome to PhCyber Community

Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads

Sign in to follow this  
Cyber

Prevent SQL Injection

Recommended Posts


SQL injection is a technique, used to attack data-driven applications. Using this method, hackers will try to execute their SQL statements within your application and access your database data.

Here is an example SQL injection. Let's consider you have a login form with two fields - email (text field) and password (password field). Upon login, you will build and execute a similar query:

 

For Established Members Only. Check this link for more info https://phcyber.com/topic/1703-phcyber-ranking/


You can see that the query is searching for a user in `users`table, which matches the email and password posted via the login form. However, since both email and password are not properly handled, an attacker can modify the query. Assume that they enter:

Email: [email protected]
Password: mypassword

The constructed query will be: 

 

For Established Members Only. Check this link for more info https://phcyber.com/topic/1703-phcyber-ranking/

 


Which seems to be correct. However, if the attacker uses:

Email: [email protected]
Password: mypassword'; DROP TABLE 'users

the query will become: 

 

For Established Members Only. Check this link for more info https://phcyber.com/topic/1703-phcyber-ranking/

 


And of course, you do not want people to execute such queries over your database.

To protect your PHP application from being abused via such SQL injections, you should correctly set all SQL queries that are being run. With older versions of PHP (>= 4.3.0, 5) you would do that with mysql_real_escape_string(). So above query would look like this:

 

For Established Members Only. Check this link for more info https://phcyber.com/topic/1703-phcyber-ranking/



This is how the SQL injection protected query looks like now:
 

For Established Members Only. Check this link for more info https://phcyber.com/topic/1703-phcyber-ranking/

You can see that the data being passed via $_POST is now escaped and DROP TABLE query will not be executed separately, but will be considered as a part of the password string.


With the latest versions of PHP you can now use PDO and prepared queries. Here is an example:

 

For Established Members Only. Check this link for more info https://phcyber.com/topic/1703-phcyber-ranking/


The key function here is prepare(). It secures the SQL query and protects it from SQL injections.

There are other ways to verify that data passed via SQL queries is valid and not abused. For example, if you expect an integer to be passed, you may use intval() to convert the inputted data into an integer.

 

For Established Members Only. Check this link for more info https://phcyber.com/topic/1703-phcyber-ranking/

 


Or if you expect an email address, you can use email validation to guarantee that $_POST["email"] is a valid email address. Take a look at our PHP Validation And Verification tutorial for different string validations.

SQL injection is one of the top website vulnerabilities, so you should be very careful when using user inputted data to construct SQL queries.

  • Like 1

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this