Six ways to protect yourself from SQL Injection
mattbearman.co.uk
Six ways to protect yourself from SQL Injection
1–9 of 9 posts
Re: Six ways to protect yourself from SQL Injection
#2And the number one way... don't use a sql database.
I worked with an object database for a couple years and not having to think about sql injections while coding was really nice.
Re: Six ways to protect yourself from SQL Injection
#3If you sanitize every input then I think you will be ok. You just have to get in the habit of always running your safe() function on every variable that comes in a POST or GET. I would also make sure that SQL errors don't return anything. The page should just die. Automated scripts testing inputs look for error messages.
Re: Six ways to protect yourself from SQL Injection
#4And the number one way... don't use a sql database. I worked with an object database for a couple years and not having to think about sql injections while coding was really nice.
Right, because there aren't any similar vulnerabilities that affect NoSQL databases... ;)
http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
Re: Six ways to protect yourself from SQL Injection
#5Use placeholders in prepared statements. "Sanitising" your input, banning magic words etc is hacky and fragile by comparison.
Re: Six ways to protect yourself from SQL Injection
#6Use placeholders in prepared statements. "Sanitising" your input, banning magic words etc is hacky and fragile by comparison.
I never thought of this. It's good
Re: Six ways to protect yourself from SQL Injection
#7Use placeholders in prepared statements. "Sanitising" your input, banning magic words etc is hacky and fragile by comparison.
I said in my article someone would show me a better way and this is it - I'd never seen prepared statements before now, but you can bet I'll be using them from now on.
For anyone else who isn't sure what they are: prepared statements involves sending a template style query and parameters to the SQL api separately, eg:
query template: "select * from users where username = ?"
Parameter: "Matt"
The SQL api knows that one is a query and one is just a parameter so injection is impossible
Re: Six ways to protect yourself from SQL Injection
#8And the number one way... don't use a sql database. I worked with an object database for a couple years and not having to think about sql injections while coding was really nice.
Right, because there aren't any similar vulnerabilities that affect NoSQL databases... ;) http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
[deleted]
Re: Six ways to protect yourself from SQL Injection
#9And the number one way... don't use a sql database. I worked with an object database for a couple years and not having to think about sql injections while coding was really nice.
Right, because there aren't any similar vulnerabilities that affect NoSQL databases... ;) http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-...
Hey, it isn't a sql injection.