0

Possible Duplicate:
Best way to prevent SQL injection in PHP?

I am building my first online shop and i'm writing the PHP code myself and using a MySQL database. I have been advised that its really important to have data validation on inputs so that my database cannot be compromised. Can someone tell me what validation to include or maybe a trusted tutorial that is recommended.

Thanks in advance

Community
  • 1
  • 1
Carl Hopwood
  • 43
  • 1
  • 5
  • unrelated to security, but you might also want to look into supporting utf8: http://stackoverflow.com/questions/279170/utf-8-all-the-way-through – user428517 Oct 24 '12 at 13:22

2 Answers2

1

Search this site for "Sql Injection". A common source of sql injection attacks is user-input which is not validated and is then trustingly concatenated before being sent to the database.

For example, if your statement is this:

select col1, col2 from mytable where id =' + <some variable> + ' and xyz = abc

(where 'some variable' is user input just passed on to the SQL)

then the user can input 'xxx''; delete from mytable; --'

and what the database gets is:

select col1, col2 from mytable 
where id ='xxx'; delete from mytable; --' and xyz = abc

causing havoc.

So the key issue here is: don't pass unvalidated, concatenated text to your database for it to execute.

You can achieve this in several ways:

  • check the input for unwanted characters (difficult to cover everthing)
  • build your SQL as parameterized SQL i.e. binding user input to parameters
  • invoke stored procedures (I like them but they are not everyone's cup of tea)

I'd go for parameterized SQL as the database driver will take care of binding everything the user inputs as a single value, whilst at the same time keeping your business logic out of the database.

davek
  • 22,499
  • 9
  • 75
  • 95
0

Mysql Validation means you have to prevent your queries from MySql injection. Please read the following to avoid mysql Injection.

http://rosstanner.co.uk/2012/01/php-mysql-preventing-mysql-injection/

Tariq Aziz
  • 788
  • 3
  • 13
  • 29