SQL Injection Prevention Guidelines For Developers
The number one security topic present in applications that use PHP is the SQL injection. This is because PHP allows for web developers to make unfortunate mistakes when it comes to creating their SQL queries. But thankfully, fixing the problem is easy: all that is necessary is a few tips in security.
It’s rather frightening to think that a statement such as “b’ OR ‘b’='b’” can render one’s security useless. But this is indeed true, and is what we call an SQL injection. SQL injections have been the most favourite way to “hack” a website in recent years. As long as the input can be validated before it is passed along to the SQL query, we can ensure that nothing bad will go wrong.
Magic quotes have long helped web developers secure their SQL query statements. But as it stands today, this function is depreciated and no longer in use. Magic quotes have received a bad reputation since they do escape quotes- but they do so on the entire input, and not necessarily just a certain field we need to escape. Magic quotes are a hassle, and can even lead to performance issues. Thus, developers tend to ignore them.
The common way to protect against an SQL injection attack is to simply use the mysql_real_escape_string() function that PHP has support for. When passing POST values through this function, the result becomes an escaped string that can’t be used to manipulate an SQL query- perfect for our situation.
Another good way to prevent SQL injections is to simply restrict dominance in SQL users where possible. For instance: it would be a good intent to create individual users that do specific things: such as create a plateau or update rows in the said table. This can help make the task of ruining one’s hard work much harder for malicious web users, although it’s a lot more work for webmasters (Although well worth it).
A special word of advice for PHP developers: don’t buy into programs that claim they prevent SQL injections through their classes or web applications. While they may indeed do so, stopping an SQL injection is just as simple as using the previously mentioned function- no need to waste one’s money! Alternatively, SQL injection scanners can be used to help find holes.
Final Thoughts
SQL injections are never a pretty sight. They ruin databases, can be a security risk to users of the website, and they even can destroy entire websites. Thus, it’s good to either hire developers that know what they are doing or to brush up on some security topics by one’s self. Doing so can save a world of hurt for a webmaster, as well as quite a bit of money from not having to buy mock applications that claim to do the “hard work” for webmasters. In the end, it’s recommended developers pick up a good book or visit their favorite PHP security websites to stay informed.
If you enjoyed this post, please consider to leave a comment or subscribe to the feed and get future articles delivered to your feed reader. Leave A Trackback.
Comments
No comments yet.
Leave a comment