How Do You Prevent Sql-injection In A Php Application Accepting User Input Strings?

Author: admin  //  Category: SQl Injection

There is only one key to prevent SQL-injection attacks - validate your user inputs.
Check to see if there are any characters that may exploit the SQL syntax e.g.
1. ‘ (single quote) - you should add another single quote so that it becomes an escape sequence
2. — (consequtive dashes, it indicates that the forthcoming characters are comment) - you should again use escape sequences.
For a detailed description on escape sequences, consult the documentation of the DBMS that you are using

Tags: , , , , , ,

2 Responses to “How Do You Prevent Sql-injection In A Php Application Accepting User Input Strings?”

  1. Deobrat Says:

    You need to find yourself a copy of the ACM Queue magazine for December 2005. Volume 3, No.10. There is a solution and description on page 13/14.

  2. ziggy_sh Says:

    Be sure u have “register_globals = OFF” in php.ini

Leave a Reply