Geek Answers Handbook

Do you even need database protection?

This is a security issue for prepared PDO reports. Using PDO, I know that the risk of sql implementation is almost impossible, and the class handles all this for you. Based on the use of their mysql_ * stack, it always seems to me that I'm not good enough at security issues. I usually use hundreds of lines of code to write to handle security, and now I'm literally just writing queries.

Are there any security risks with PDO statements that I have to worry about besides the line length in db?

+4
source share
2 answers

Definitely yes.

In fact, native prepared statements are only good for simple cases of school books.
So, you still have to write a few "hundreds of lines" for any difficult cases. I made a small collection of such cases in wiki PDO tags . The main disadvantages are

  • no placeholders for identifiers. You must format and enter them manually, as in the old good mysql_ * code.
  • no placeholders for arrays. This means that you still have to write the code manually and then enter it into the request - so there is still the opportunity to slip into some kind of problem.

Therefore, you need a higher level of abstraction, even with PDO. A common solution is to use a kind of Query Builder that every modern structure offers.

But personally, I hate query builders because they seem too bloated to me, pretending to replace all of SQL, but clearly can't handle it. So, I don’t understand why to use SQL written in PHP when I can use pure SQL. To do this, I created my own abstraction library to fix all the shortcomings of the native prepared statements, safeMysql . It has placeholders for everything you need, and thus makes requests much safer than PDOs, but makes application code much shorter.

So with safeMysql you really can "just literally write queries":

$sql = "SELECT * FROM articles WHERE id IN(?a) ORDER BY ?n LIMIT ?i" $data = $db->getAll($sql, $ids,$_GET['order'], $limit); $sql = "INSERT INTO stats SET pid=?i,ip=inet_aton(?s),?u ON DUPLICATE KEY UPDATE ?u"; $db->query($sql, $pid, $ip, $data, $data);

Just compare these 2 liners with the amount of code you will need to write using raw PDO.

+2
source

I think the answer is pretty close to yes for "SQL injection". mysqli prepared statements and mysqli_real_escape_string

There are many more types of attacks, but at least all of your values ​​are escaped.

Relying on PDO to “fix” your security, you rely on the compiler to find your mistakes.

0
source

More articles:


All Articles