0

Is there any automatic SQL injection prevention PHP libraries. Something like, check the incoming parameters like GET,POST and check the possible SQL attack signatures before continue executing the site's codes.

Like example: http://www.example.com/index.php?page_id=')//UniON//aLL//SELECt//nULL,nULL,nULL,nULL,nULL,nULL,nULL,nULL,nULL,nULL--/**/uHkS

In above URL I have passed sql syntax in GET parameter, PHP libraries will check the GET, POST parameters before the project codes started executing and if any SQL attacks include, will exist the request immediately.Throw an exception message.

Dipankar Biswas
  • 25
  • 3

2 Answers2

0

As had been written in the other comments: There is no library to automatically detect attacks on your database via request.

It would be a really bad to immediately cancel the request if there is data incoming which could cause a threat to database operations.

Just take a normal form with an input for the name of the use. His name is Brian O'Connor... well, seems he won't be able to use your program.

The library would need to have a semantic check to see, if the user wants to mess up your database. To do this semantic check, the library would also need to know what kind of data is actually expected. In the mentioned example, when expecting a name you might be sure "drop table" would be not wanted input, but it would be a lot of overhead to define the rules of what is wanted for every input.

If you always treat the userdata correctly (By using prepared statements or the escaping/quoting-function of your database-api), you will have some weird data in your tables (if someone actually tries to inject you sql) but that won't hurt you I guess.

Philipp
  • 2,787
  • 2
  • 25
  • 27
-2

There are things you can do on the database end by using PDO or Prepared Statements or you can sanitize POST or GET data on the server side script's end. 

$safe_data=filter_input(INPUT_GET, 'comment', FILTER_SANITIZE_SPECIAL_CHARS);

Because this function only works on a single GET parameter at a time, you might want to write a function to make a new array (e.g. $SAFE_GET) which iterates through the GET parameters and sanitizes them all in one go.

Alternatively you can set a directive in the php.ini file to default to sanitizing all input for HTML safety:

filter.default="special_chars"

I don't think there are php libraries that can sanitize that; you have to be careful with how you handle your data.

For both POST and GET, sanitize user input. With all types of Fuzz Testing and performing Q & A, you application should be secured.

unixmiah
  • 3,081
  • 1
  • 12
  • 26