Contents
How to protect your PHP website from SQL injection?
As a web developer, I often read articles about hackers (from the lowly to the knowledgeable) infiltrating websites via the dreaded ‘SQL Injection’ method and completely taking control, changing, gaining access, or destroying the owner’s data. As a fellow web developer, I’m sure you want to know how to protect against it. Well, here it is!
How is SQL injection used in a web application?
SQL Injection (SQLi) is a type of injection attack. An attacker can use it to make a web application process and execute injected SQL statements as part of an existing SQL query. This article assumes that you have a basic understanding of SQL Injection attacks and the different variations of SQL Injection.
Why is SQL injection such a security risk?
A few examples of SQL Injection are available for review at the following resources: Why is SQL Injection such a security risk for the campus? Attackers are constantly probing the Internet at-large and campus web sites for SQL injection vulnerabilities.
How does input validation help avoid SQL injection?
We explained, how important input validation is, how bad it is to include untrusted data (user input) directly in an SQL query, and how prepared statements help you avoid SQL Injection attacks. In the second part, we focus on two other common and dangerous PHP vulnerabilities and attack types: directory traversal and code injections attacks.
Why do I need to use code injection in PHP?
Server-side code injection vulnerabilities arise when an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter. If the user data is not strictly validated, an attacker can use crafted input to modify the code to be executed, and inject arbitrary code that will be executed by the server.
What should be the whitelist for PHP code injection?
Ideally, a whitelist of specific accepted values should be used. Otherwise, only short alphanumeric strings should be accepted. Input containing any other data, including any conceivable code metacharacters, should be rejected.