29
May
How Do You Prevent Sql-injection In A Php Application Accepting User Input Strings?
Author: admin // Category: SQl InjectionThere is only one key to prevent SQL-injection attacks - validate your user inputs.
Check to see if there are any characters that may exploit the SQL syntax e.g.
1. ‘ (single quote) - you should add another single quote so that it becomes an escape sequence
2. — (consequtive dashes, it indicates that the forthcoming characters are comment) - you should again use escape sequences.
For a detailed description on escape sequences, consult the documentation of the DBMS that you are using
Tags: Accepting, Application, Input, Prevent, Sqlinjection, Strings, User
May 30th, 2009 at 1:32 am
You need to find yourself a copy of the ACM Queue magazine for December 2005. Volume 3, No.10. There is a solution and description on page 13/14.
May 30th, 2009 at 2:02 am
Be sure u have “register_globals = OFF” in php.ini