PreparedStatements are the way to go, because they make SQL injection impossible. Here’s a simple example taking the user’s input as the parameters: public insertUser(String name, String email) { Connection conn = null; PreparedStatement stmt = null; try { conn = setupTheDatabaseConnectionSomehow(); stmt = conn.prepareStatement(“INSERT INTO person (name, email) values (?, ?)”); stmt.setString(1, name); stmt.setString(2, … Read more
The idea is very simple – the query and the data are sent to the database server separately. That’s all. The root of the SQL injection problem is in the mixing of the code and the data. In fact, our SQL query is a legitimate program. And we are creating such a program dynamically, adding … Read more
The short answer is NO, PDO prepares will not defend you from all possible SQL-Injection attacks. For certain obscure edge-cases. I’m adapting this answer to talk about PDO… The long answer isn’t so easy. It’s based off an attack demonstrated here. The Attack So, let’s start off by showing the attack… $pdo->query(‘SET NAMES gbk’); $var … Read more
The short answer is yes, yes there is a way to get around mysql_real_escape_string(). #For Very OBSCURE EDGE CASES!!! The long answer isn’t so easy. It’s based off an attack demonstrated here. The Attack So, let’s start off by showing the attack… mysql_query(‘SET NAMES gbk’); $var = mysql_real_escape_string(“\xbf\x27 OR 1=1 /*”); mysql_query(“SELECT * FROM test … Read more
It drops the students table. The original code in the school’s program probably looks something like q = “INSERT INTO Students VALUES (‘” + FNMName.Text + “‘, ‘” + LName.Text + “‘)”; This is the naive way to add text input into a query, and is very bad, as you will see. After the values … Read more
It’s a common misconception that user input can be filtered. PHP even has a (now deprecated) “feature”, called magic-quotes, that builds on this idea. It’s nonsense. Forget about filtering (or cleaning, or whatever people call it). What you should do, to avoid problems, is quite simple: whenever you embed a a piece of data within … Read more
The correct way to avoid SQL injection attacks, no matter which database you use, is to separate the data from SQL, so that data stays data and will never be interpreted as commands by the SQL parser. It is possible to create an SQL statement with correctly formatted data parts, but if you don’t fully … Read more