Home » Internet » Web Development

How To Prevent Disastrous SQL Injection Attacks

Jul 17, 2008
The number one security topic present in applications that use PHP is the SQL injection. This is because PHP allows for web developers to make unfortunate mistakes when it comes to creating their SQL queries. But thankfully, fixing the problem is easy: all that is necessary is a few tips in security.

SQL injections are defined by the vulnerability in the SQL query that PHP developers make use of. When the developer in question puts forth an SQL query, he or she needs to make an effort to validate any input that could come from any web form or entry field. A simple input statement such as "a' OR 'a'='a'" could compromise the security of one's database with ease.

As long as we can escape the quote that needs to be used in the injection, we can prevent any type of harm that may come to a web application. The first way to accomplish this is to simply use magic quotes. It should be noted that magic quotes are no longer supported as of PHP 6, and shouldn't be used. Instead, we leave SQL injection prevention up to a newer and more dependable command.

The common way to protect against an SQL injection attack is to simply use the mysql_real_escape_string() function that PHP has support for. When passing POST values through this function, the result becomes an escaped string that can't be used to manipulate an SQL query- perfect for our situation.

Another good way to prevent SQL injections is to simply restrict authority in SQL users where possible. For instance: it would be a good idea to create individual users that do specific things: such as create a table or update rows in the said table. This can help make the task of ruining one's hard work much harder for malicious web users, although it's a lot more work for webmasters (Although well worth it).

It should be noted that programs and web applications that stop SQL injections should not be obtained- since they commonly cost quite a bit of money. As long as webmasters take precautions with what they create, there should be no reason to spend hundreds of dollars on software that only makes use of escape characters and formatting data correctly. This type of application is created to con webmasters into buying something they don't need- so dont fall victim to them!

Closing Comments

Security is a big topic among webmasters, who make no money and achieve no fame by getting attacked via an SQL injection. To keep profits running high, it is recommended that webmasters make use of the tips previously mentioned. It's also good to brush up on more PHP security tips, as well as make use of SQL injection scanners that are available over the Internet.
About the Author
Rating:
Please Rate:
(Average: Not rated)
Views: 200
Print Email Report Share
Article Categories