Geek Answers Handbook

Signs that the SQL statement is dangerous

I want to create a function in PHP that checks how dangerous an SQL statement is. When I say “dangerous,” I mean some characters, characters, or strings that are used to get data from a database that the user should not see.

For instance:

SELECT * FROM users WHERE userId = '1'

can be entered in several ways. Although I clear the parameters, I also want to keep track of how secure the request to run is.

Thanks in advance

+5
source share
5 answers

, Parametrized Queries - . php/mysql mysql_query(), - - SQL-.

Suhosin Hardened PHP LAMP " SQL-" , , . - (WAF), , SQL- HTTP-. WAF PCI-DSS, , .

GreenSQL, , -. , SQL - , , . , secuirty , . WAF , GreenSQL, , , . , , , .

+2

sql sql-.

+1

"" . . - "O'Reilly" ?

SQL, , SQL. "" - : .

SQL, - , , , . , SELECT * , , .

+1

, :

  • . , .
  • SQL .
  • Protect the data layer as long as you can, applying the principle of minimal privilege and restriction of public access to absolutely necessary functions, i.e. not allowing write access to many tables.

You may find this helpful: OWASP Top 10 for .NET Developers Part 1: Injection

It is written for .NET developers, but the principles are passed along with PHP.

+1
source

More articles:


All Articles