How to protect mysql database from sql-injection?

Question

I am new to databases and security.

I am planning to put up a website.

I've read that sql-injection vulnerabilities can be very dangerous since the server might leak user passwords and credit-card information.

Are there any steps that I need to follow to prevent SQL injection vulnerabilities?

I was going through a wiki on sql-injection, but I didn't understood the following query:

SELECT * FROM users WHERE name = '" + userName + "';

You may want to add more information about what you don't understand about the query. Is it the double-quotes you don't understand, or the entire query? If you are new to databases and security, and are concerned about SQL injection vulnerabilities, you would do well to take a course, or better yet, hire a professional. SQL Injection is a very complex topic and not easily covered in a simple question and answer format such as this.
If you are worried about leaking credit card information, you really, really need to hire a security and database professional.
@MaxVernon, it's the combination of the single quote and the double quote that is confusing me and the '+'.
The double-quotes prevent escaping from the intended query by using a single quote embedded within the userName variable. Consider what would happen if userName was filled in by the user as: ';DROP TABLE users + ' - this would have the unfortunate side effect of deleting the Users table, with no warning, and no way of preventing it. The double-quotes encapsulate the bad query, essentially forcing it to be evaluated as part of the WHERE clause.

Mahbub · Answer 1 · 2012-09-27 20:28:19Z

up vote 0 down vote

you better use prepared statement from your programming source code, e.g. for PHP use PDO's prepare statement!

edited Sep 27 '12 at 20:28

answered Sep 27 '12 at 9:23

Mahbub
12

	You may want to add some reasoning behind your suggestion so the original poster has a better understanding of what you are proposing. – Max Vernon Sep 27 '12 at 19:08
	@MaxVernon - thanks – Mahbub Sep 27 '12 at 20:03
	@Ankit lease check this thread - stackoverflow.com/questions/60174/… – Mahbub Sep 27 '12 at 20:03

1 Answer