One of the biggest flaws in the PHP language is the fact that it allows for web developers to make very big mistakes in regards to security. One example of this is through SQL injections- an exploit that malicious users take advantage of when web developers don't accurately safeguard their application.
It's rather frightening to think that a statement such as "b' OR 'b'='b'" can render one's security useless. But this is indeed true, and is what we call an SQL injection. SQL injections have been the most popular way to "hack" a website in recent years. As long as the input can be validated before it is passed along to the SQL query, we can ensure that nothing bad will go wrong.
As long as we can escape the quote that needs to be used in the injection, we can prevent any type of harm that may come to a web application. The first way to accomplish this is to simply use magic quotes. It should be noted that magic quotes are no longer supported as of PHP 6, and shouldn't be used. Instead, we leave SQL injection prevention up to a newer and more dependable command.
Using the "mysql_real_escape_string()" function will enable web developers to escape quotes properly. And unlike magic quotes, this function will only escape quotes that we need. Keep in mind that when using this function, it may be necessary to use the "striplslashes()" function to counteract the slashes that are being outputted as a result.
Another good way to prevent SQL injections is to simply restrict authority in SQL users where possible. For instance: it would be a good idea to create individual users that do specific things: such as create a table or update rows in the said table. This can help make the task of ruining one's hard work much harder for malicious web users, although it's a lot more work for webmasters (Although well worth it).
A special word of advice for PHP developers: don't buy into programs that claim they prevent SQL injections through their classes or web applications. While they may indeed do so, stopping an SQL injection is just as simple as using the previously mentioned function- no need to waste one's money! Alternatively, SQL injection scanners can be used to help find holes.
Final Thoughts
SQL injections are never a pretty sight. They ruin databases, can be a security risk to users of the website, and they even can destroy entire websites. Thus, it's good to either hire developers that know what they are doing or to brush up on some security topics by one's self. Doing so can save a world of hurt for a webmaster, as well as quite a bit of money from not having to buy mock applications that claim to do the "hard work" for webmasters. In the end, it's recommended developers pick up a good book or visit their favorite PHP security websites to stay informed.
$Result =Select * from members where username='$x' and password= '$y';
This is typically a code used for user authentication, in which username and password are collected into variables $x and $y .The students and many web designers assume that such queries are safe and the system is well protected.They also assume that people will give simple strings to the variables $x and $y.
But such lazy coding gives raise to a kind of attack popularly known as SQL injection attack.The attcak primarily consists of inserting SQL queries into the variables and hence getting unauthorized acess. The attacker may get into an admin account. Also he may enter more dangerous commands like insert, Drop etc. into SQL and cause havoc into your database.
Also this is not special to any programming language. Almost all server/client side programming is prone to this. An SQL may be injected to user registration, searches, and similar things.
Another common type of SQL injection attack is by injecting the SQL into the URL directly.
It was seen in the past that many ecommerce sites lost their data andsuffered because of such attacks.
How to prevent this? The only way to prevent this is to adhere to secure coding practices at the database and server levels.
1.Database level: A user must have only the bare necessary privileges to the database. This is called "the principle of least privileges" Don't give the connecting user privileges such as drop, delete etc on databases unless it is absolutely needed. This will ensure that damage to the database is minimized.
2.Programming level Do not pass the query string generated by the user directly onto the database. First pass it through a security layer which checks for unwanted characters, replaces a spurious commands etc. and blocks the query if it is suspicious. For example the security layer may find that in the variables passed by the user, there are unnecessary quotes and change them. You can design an abstract security layer, which works for all types of databases and stop attacks.Also many resourses including code are available on the web.What one needs is an awareness of this problem and willingness to read and adopt the techniques.
This is only an elementary exposure to the technique of SQL injection. There are many specific articles dealing with the problem with different databases. some useful links to such articles are given in my blog http:wbforu.blogspot.com.
Article Source :
About Author
Both Chris Channing & Kannan Balakrishanan are contributors for EditorialToday. The above articles have been edited for relevancy and timeliness. All write-ups, reviews, tips and guides published by EditorialToday.com and its partners or affiliates are for informational purposes only. They should not be used for any legal or any other type of advice. We do not endorse any author, contributor, writer or article posted by our team.
Kannan Balakrishanan has sinced written about articles on various topics from Start Online Business. Dr.Kannan Balakrishnan is a computer expert and writer. He also writes abouut web business in the blog http://wbforu.blogspot.com/. An expanded version of the above arti. Kannan Balakrishanan's top article generates over 33100 views. Bookmark Kannan Balakrishanan to your Favourites.