 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 105
 Members: 0
 Total: 105
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
SQL Injection: What is safe? |
|
 Posted: Tue Jun 19, 2007 9:04 pm |
 |
|
| Lord_Vader |
| Regular user |
 |
|
| Joined: Jan 04, 2007 |
| Posts: 5 |
| Location: Netherlands |
|
|
 |
|
 |
|
SQL Injection: What is safe?
I'm writing a web application and ofcourse it has to be safe, so what is safe? Since SQL Injection is a upcoming trend I need make sure my app is 100% safe from SQL Injection attacks. I don't believe you can prevent a succesfull Injection by just escape your data with mysql_real_escape_string() (PHP). What is your advice?
Lord_Vader |
|
|
|
|
|
|
|
|
| Posted: Wed Jun 20, 2007 12:04 am |
|
|
| drag |
| Active user |
|
|
| Joined: May 31, 2007 |
| Posts: 25 |
|
|
|
|
|
|
|
mysql_real_escape_string() is supposed to do a pretty good job. If magic_quotes_gpc is enabled, first apply stripslashes() to the data. Using this function on data which has already been escaped will escape the data twice. Also note mysql_real_escape_string() does not escape % and _. These are wildcards in MySQL if combined with LIKE, GRANT, or REVOKE.
Also, ensure that all user input is limited to a set length. Choose the characters that are allowed for input and manually ensure, server side, that those are the only ones that are accepted.
I think that would cover it pretty well. Correct me if I'm wrong. |
|
|
|
|
www.waraxe.us Forum Index -> Sql injection
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
