When articles talk about parameterized queries stopping SQL attacks they don’t really explain why, it’s often a case of “It does, so don’t ask why” — possibly because they don’t know themselves. A sure sign of a bad educator is one that can’t admit they don’t know something. But I digress. When I say I … Read more
Yes you need to protect against this. Let me show you why, using Firefox’s developer console: If you don’t cleanse this data, your database will be destroyed. (This might not be a totally valid SQL statement, but I hope I’ve gotten my point across.) Just because you’ve limited what options are available in your dropdown … Read more
The node-mysql library automatically performs escaping when used as you are already doing. See https://github.com/felixge/node-mysql#escaping-query-values
Can someone explain SQL injecton? SQL injection happens when you interpolate some content into a SQL query string, and the result modifies the syntax of your query in ways you didn’t intend. It doesn’t have to be malicious, it can be an accident. But accidental SQL injection is more likely to result in an error … Read more
I think the correct answer is: Don’t try to do security yourself. Use whatever trusted, industry standard library there is available for what you’re trying to do, rather than trying to do it yourself. Whatever assumptions you make about security, might be incorrect. As secure as your own approach may look (and it looks shaky … Read more
I think it’s safe… technically, but it’s a terrible habit to get into. Do you really want to be writing queries like this? var sqlCommand = new SqlCommand(“SELECT * FROM People WHERE IsAlive = ” + isAlive + ” AND FirstName = @firstName”); sqlCommand.Parameters.AddWithValue(“firstName”, “Rob”); It also leaves you vulnerable in the situation where a … Read more
When it comes to database queries, always try and use prepared parameterised queries. The mysqli and PDO libraries support this. This is infinitely safer than using escaping functions such as mysql_real_escape_string. Yes, mysql_real_escape_string is effectively just a string escaping function. It is not a magic bullet. All it will do is escape dangerous characters in … Read more
Using parameters helps prevent SQL Injection attacks when the database is used in conjunction with a program interface such as a desktop program or web site. In your example, a user can directly run SQL code on your database by crafting statements in txtSalary. For example, if they were to write 0 OR 1=1, the … Read more
First of all, it’s just bad practice. Input validation is always necessary, but it’s also always iffy. Worse yet, blacklist validation is always problematic, it’s much better to explicitly and strictly define what values/formats you accept. Admittedly, this is not always possible – but to some extent it must always be done. Some research papers … Read more
Consider two ways of doing the same thing: PreparedStatement stmt = conn.createStatement(“INSERT INTO students VALUES(‘” + user + “‘)”); stmt.execute(); Or PreparedStatement stmt = conn.prepareStatement(“INSERT INTO student VALUES(?)”); stmt.setString(1, user); stmt.execute(); If “user” came from user input and the user input was Robert’); DROP TABLE students; — Then in the first instance, you’d be hosed. … Read more