I know basically what it is but I have looked around and cannot find a clearcut answer on what I should do to avoid it. Like in this case for example
“SELECT * FROM USERS WERE USERNAME =” + username
or something like that. How do I make it so the characters can be escaped or what do I need to do?
Tags: Injection, Vulnerability
May 31st, 2009 at 5:29 am
The big danger out there is the apostrophe.
If someone’s user name happens to be:
bob’ drop table tblUsers
You just lost your user’s table.
You can try filtering apostrophes out. Sometimes that’s a viable option.
However, generally recommended that you don’t make direct SQL queries to your database.
Instead use a Stored Procedure.
If everything is being called from a Stored Procedure, you generally don’t have to worry about the evil apostrophe.
But if the scope of the project is such that making Stored Procedures for everything is overkill, just make sure you always filter out apostrophes from anything that you use to build a SQL command. Otherwise the haxx0rs will have you for breakfast.
May 31st, 2009 at 11:38 am
Before you pass your query in SQL you should handle that in your code. Whether that’s PHP, Java or ASP.NET
For example PHP got function sqlesc functions and etc.
So I guess it depends on a technology you are using.
But that’s where you would get that done. You can show some code - I’ll show some examples.
May 31st, 2009 at 11:51 am
Here is a terrific wiki article on SQL injection and the two way to make sure that you are not a victim of it.http://en.wikipedia.org/wiki/SQL_injecti…