How to prevent SQL injection attacks?
A few basic steps can help prevent a lot of issues:
Do code reviews so that there everything changed is double checked and looked at with a fresh set of eyes.
Don't allow escape characters.
Use parameterized statements so that data is filtered prior to being sent to the database.
- Share this answer
- Permalink
This is the topic of a detailed "SQL Prevention Cheat Sheet" by The Open Web Application Security Project, or OWASP. Here's a key excerpt:
"SQL Injection flaws are introduced when software developers create dynamic database queries that include user supplied input. To avoid SQL injection flaws is simple. Developers need to either: a) stop writing dynamic queries; and/or b) prevent user supplied input which contains malicious SQL from affecting the logic of the executed query."
The cheat sheet runs through explanations of several "primary defenses," including Prepared Statements (Parameterized Queries), Stored Procedures and Escaping All User Supplied Input.
- Share this answer
- Permalink
Related Questions
Is Palo Alto the only true NGFW? SonicWall? Juniper SRX? Do you think that Gartner's definition of a NGFW is correct? Does anyone know...
I've been in IT for awhile, and am considering a shift to focus more on security and related technologies, policies, etc. What kinds of...
Are there reputable security applications out there for BlackBerry, Android, and iPhone that will protect my business emails, chats, and...
Yes, it's true that everyone should know better, and should be backing up data to an off-site facility on a regular basis. But, in...
Cloud computing security is approached from two directions; the cloud provider, and the end user. Regarding the provider, our strategy...
How to Prevent a SQL Injection Attack
http://www.developerdrive.com/2011/10/how-to-prevent-a-sql-injection-att...
"A SQL injection is a common programming error the consequences of which can be really devastating. Many successful hacking attacks start when a hacker discovers a vulnerability that gives an opportunity to inject SQL code.
When an SQL injection occurs, the structure of an SQL query is compromised and as a result you are left at the mercy of the potential hackers. If there is a vulnerability found, hackers can exploit it to gain access not only to your site and database but in extreme cases also to your corporate network. When hackers can inject their code in your code, they can do what they want."