The ways of protecting websites from SQL injection attacks

Question

Hi friends. I want to know about the ways of protecting my websites from SQL injection attacks so please explain about the subject. Thank you.

Vivek Kumar · Answer

Have a look to the below links for your reference. https://www.sitepoint.com/how-to-protect-your-website-against-sql-injection-attacks/ https://www.cloudways.com/blog/protect-php-website-sql-injection/ https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

Joe Wilson · Answer

Well Thank you for your answers.

Kesavan Krishnan · Answer

? In PHP Always try to use PDO prepared statement to avoid the sql injection. In PDO: $query = $pdo -> prepare ( 'SELECT * FROM products WHERE name = :name' ); $query -> execute ( array ( 'name' => $name )); foreach ( $query as $result ) { // do logic on the data } ?> In Mysqli: $query = $dbConnection -> prepare ( 'SELECT * FROM products WHERE name = ?' ); $query -> bind_param ( 's'  $name ); $query -> execute (); $result = $stmt -> get_result (); while ( $row = $result -> fetch_assoc ()) { // do login on data } ?> The same way  you use for insert update and delete. More info : https://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection

Joe Wilson · Answer

Well I am using mySQL database and microsoft somehow use SQL server databases and there are some differences between them.

Daniel Jones · Answer

take a look at this link hope it helps http://www.sqlserverlogexplorer.com/prevent-sql-injection-in-sql-server/

Nitin Sontakke · Answer

No. That is from my head...however after posting answer I noticed that you have asked question in PHP section and who knows you might be using MySQL. But while posting i just assumed that you are asking in context of SQL Server. So thought of clarify it.

Joe Wilson · Answer

Well Thank you very much. You mean you have achieved this data from microsoft website?

Nitin Sontakke · Answer

My comments are applicable exclusively for Microsoft SQL Server.

Nitin Sontakke · Answer

While the list given below is in now way exhaustive it is a good start: 1/ Write all your code in stored procedures. 2/ Stored procedure parameters should be exactly of the same type and size as the corresponding column in the table. 3/ Use Windows authentication instead of SQL Server authentication. For accessing SQL Server create a separate restrictive Windows Account which has bare minimum permissions. 4/ Use encrypted connection string everywhere. 5/ Do not give any permissions on the underlying objects such as tables. Give permissions only on stores procedures and views. 6/ Do not give explicit execute permissions to procedures which are strictly being called from another stored procedure. This is what is quickly coming to mind on morning after heavy New Year Eve celebration.