SQL Injection Prevention Guidelines For Developers
Posted on July 16, 2008
Filed Under Computer Security |
SQL injection is becoming a problem for web developers- especially those new to the field who aren’t up to speed on how insecure PHP can really be. But as the experts like to say, PHP isn’t the problem- it’s the knowledge of the programmer that counts when it comes to preventing SQL injection attacks.
It’s rather frightening to think that a statement such as “b’ OR ‘b’='b’” can render one’s security useless. But this is indeed true, and is what we call an SQL injection. SQL injections have been the most popular way to “hack” a website in recent years. As long as the input can be validated before it is passed along to the SQL query, we can ensure that nothing bad will go wrong.
PHP developers have used the magic quotes function to help safeguard against SQL injections. Magic quotes are no longer in use, however, since they were more of a hassle than anything. It is recommended that if a developer has used magic quotes, he or she should remove them since they are no longer supported as of PHP 6. Thus, we need to look elsewhere for a security solution.
There is but one simple solution when it comes to getting rid of the threat of an SQL injection. This simplle solution comes via the function mysql_real_escape_string(). This function was created specifically for safeguarding against SQL injections, so it’s well worth the time to use. Just pass any values being inserted through this function, and the result is a perfectly escaped string.
Oddly enough, we can create a greater sense of security through creating more user accounts via our SQL program. We can assign different types of access to different users, which would make it quite hard for attackers to get full access to our database should they find a hole somewhere. Having a user for creating, deleting, and inserting data is a good idea to help split up responsibility.
A special word of advice for PHP developers: don’t buy into programs that claim they prevent SQL injections through their classes or web applications. While they may indeed do so, stopping an SQL injection is just as simple as using the previously mentioned function- no need to waste one’s money! Alternatively, SQL injection scanners can be used to help find holes.
Closing Comments
SQL injections are never a pretty sight. They ruin databases, can be a security risk to users of the website, and they even can destroy entire websites. Thus, it’s good to either hire developers that know what they are doing or to brush up on some security topics by one’s self. Doing so can save a world of hurt for a webmaster, as well as quite a bit of money from not having to buy mock applications that claim to do the “hard work” for webmasters. In the end, it’s recommended developers pick up a good book or visit their favorite PHP security websites to stay informed.
Comments
Leave a Reply