Preventing an SQL injection attack
• What steps would you take to prevent an SQL injection attack?
• What are advantages and disadvantages of dynamic SQL statements?
• What types of databases are more vulnerable to SQL injections?
Sample Solution
Preventing an SQL injection attack.
Structured Query Language [SQL] injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. Steps taken to prevent an SQL injection attack include: trust no one. Assume all user-submitted data is evil so use input validation via a function such as MySQL to ensure that any dangerous characters are not passed to a SQL query in data; don’t use dynamic SQL. Don’t construct queries with user input. Use prepared statements, parameterized queries or stored procedures whenever possible. However, while stored procedures prevent some types of SQL injection attacks, they fail to protect against many others, so don’t rely exclusively on their use for your security. Most SQL injection attacks occur on MySQL database frequently used by applications like Joomla and WordPress.
