If SQL-Injection were to happen how do you reverse it

Question

I am going to get into database designing and PHP. But when I do I am very worried about SQL-Injecting. Is there anyway to reverse this when it happens. Like auto reset it, or delete the account thats hacked, or close the databases. Also is there a way that it can be Auto-Tested for intruders?

A way to reverse is to create periodic backups of your database. — Edu, May 25 '16 at 13:26

score 3 · Answer 1 · edited May 23 '17 at 11:52

This is an immensely complex question. Short answer is: No, if no backups exist

The long answer: You should mainly focus on how to prevent sql injection, for example using prepared statements is a good method to prevent these attacks. Regardless of potential sql-injection vulnearbilities regular backups should be made and stored at a different physical location. The datacenter of the server with the database might burn down and your data is gone. Though this is very unlikely to happen it is not impossible.

Depending on the importance of the data in your database there are ways (for example cron jobs) to do backups weekly, dayly, every hour and so on. If you have a second server you can write a script that sends the backup to the seconds server or you log in from time to time and download them.

You could also log all interaction and changes in the database but reversing the damage done in this way is not practical.

This link might be interesting for you: Prevent SQL Injection in PHP

I am glad I could help. If you need any more information feel free to ask :) — JRsz, May 27 '16 at 06:02

score 1 · Answer 2 · answered May 25 '16 at 13:31

1

If you get a SQL injection the attacker gets the same privileges as your application, they can delete or change whatever they want so basically you're out of luck. You can restore your database from a backup but then you'd lose whatever changes happened between the backup and the attack.

Instead of trying to detect and revert SQL injection you'd better avoid allowing them in the first place, a good way to avoid SQL injections is to use PDO's prepared statements.

answered May 25 '16 at 13:31

Jean-Karim Bockstael

1,385
9
18

2

Of course, you should still take regular backups of your database – Mark Baker May 25 '16 at 13:32
Thank you for answering and trying to help, I am sad that thats the only reverse type – Austin Gummy May 26 '16 at 18:47

score 0 · Accepted Answer · answered May 25 '16 at 14:16

To put it simply, if it happens, you pretty much already lost. Disconnect the database from the internet and assess the damage, dump the damaged version for later analysis or whatnot, and restore to the closest non-broken backup, is probably the best course of action in most situations.

But what you should do is prevent it in the first place. While it is possible to do escaping and/or pattern checks, it is much better to solve it with prepared/parameterized statements and/or object-relational mapping. A lot of the major frameworks comes with some form of ORM, and unless you are either super-confident about covering all security holes or in a situation where security is completely optional, I seriously recommend you to use something like that. Aside from SQL injection, this will also protect you from a variety of other security risks, and help you in other ways.
For example, have a look at FuelPHP.

Thank you for this help I wanted to create a chat site for this school and I'm glad that you helped me — Austin Gummy, May 25 '16 at 15:53
@AustinGummy Great, glad to be of help! I recommend you pick an accepted answer, or comment on the ones that were insufficient and explain what they missed. This will give you and others reputation score, and it will encourage people to answer questions. — StubbornShowaGuy, May 26 '16 at 03:34

If SQL-Injection were to happen how do you reverse it

3 Answers3