How to protect your site from local file inclusion and SQL injection in PHP?

Question

How do you protect your site from local file inclusion and SQL injection (PHP)?

Answer 1

There are many measures that need to be taken. Be sure to clear all input before storing in the database. I suggest using mysql_real_escape_string () for all the data that will be saved. Limit character input to reasonable lengths and make sure that you get the TYPE of data that you expect for this field. Block multiple attempts to send specific data areas. Scan the contents of downloaded files looking for malicious patterns.

Wikibooks SQL Injection;

• http://en.wikibooks.org/wiki/Programming:PHP:SQL_Injection

. , .

Answer 2

SQL (. PDO::prepare()) (PDO::quote()).

(, : preg_replace('/[^a-z]/','',$str)) ( , ..)

Answer 3

http://php.net/manual/en/security.php

Answer 4

SQL- PDO (http://us3.php.net/pdo). .., , .

, , , mysql_real_escape_string()

Answer 5

" ", , include() , , , CMS ? , , SQL- - .

, , , , . , , :

• , ., .. / ( \ Windows)
• -
• include

PHP . open_basedir, , " " PHP, ( PHP 6.0), .

Answer 6

, mysql\_real\_escape\_string() SQL. DB SQL, sanitize(). sanitize , .

/**
* Sanitize variable for querying
*
* @param mixed $var         The variable to sanitize
* @param bool $deep         Will inspect the string deeper, converting 'null' to NULL and adding '' around strings
* @param mixed $numstrings  Whether or not to treat numbers as strings (ie add quotes)
* @return $var
*/
function sanitize($var, $deep = true, $numstrings = false) {
    if (is_array($var)) {   //run each array item through this function (by reference)
        foreach ($var as $key=>$val) {
        $var[$key] = sanitize($val, $deep, $numstrings);
        }
    }
    else if (is_null($var) || ( $deep && preg_match('/^null$/i', $var) > 0 ) ) {   //convert null variables to SQL NULL
        $var = "NULL";
    }
    else if (is_bool($var)) {   //convert boolean variables to binary boolean
        $var = ($var) ? 1 : 0;
    }
    else if ($numstrings && is_string($var)) {
        $var = mysql_real_escape_string($var);
        if ($quotes) {
        $var = "'". $var ."'";
        }
    }
    else if (!is_numeric($var)) { //clean strings
        $var = mysql_real_escape_string($var);
        if ($deep) {
        $var = "'". $var ."'";
        }
    }
    return $var;
}

" ", . , .

, '.ht' . Apache , ".ht". , Apache (.htaccess,.htpasswd ..).

, , ( , ). .htaccess, ( PHP).

#this is all you need in the file
Order Allow , Deny
Deny from all

Answer 7

to avoid SQL injection, encrypt your password before sending