I am new to databases and security.

I am planning to put up a website.

I've read that sql-injection vulnerabilities can be very dangerous since the server might leak user passwords and credit-card information.

Are there any steps that I need to follow to prevent SQL injection vulnerabilities?

I was going through a wiki on sql-injection, but I didn't understood the following query:

SELECT * FROM users WHERE name = '" + userName + "';
  • You may want to add more information about what you don't understand about the query. Is it the double-quotes you don't understand, or the entire query? If you are new to databases and security, and are concerned about SQL injection vulnerabilities, you would do well to take a course, or better yet, hire a professional. SQL Injection is a very complex topic and not easily covered in a simple question and answer format such as this.
    – Hannah Vernon
    Sep 27 '12 at 2:45
  • If you are worried about leaking credit card information, you really, really need to hire a security and database professional.
    – Hannah Vernon
    Sep 27 '12 at 2:46
  • @MaxVernon, it's the combination of the single quote and the double quote that is confusing me and the '+'.
    – Ankit
    Sep 27 '12 at 5:57
  • The double-quotes prevent escaping from the intended query by using a single quote embedded within the userName variable. Consider what would happen if userName was filled in by the user as: ';DROP TABLE users + ' - this would have the unfortunate side effect of deleting the Users table, with no warning, and no way of preventing it. The double-quotes encapsulate the bad query, essentially forcing it to be evaluated as part of the WHERE clause.
    – Hannah Vernon
    Sep 27 '12 at 6:02

you better use prepared statement from your programming source code, e.g. for PHP use PDO's prepare statement!

Check this - https://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php


I used a private function that vetted all the parameters passed into my services (Models in today's parlance). In a large application you might as well make it a 'global' function that all your scripts/models access when you're accepting any parameters from your frontend

private function protectMySQL($myParam)
    $myParam = stripslashes($myParam);
    $myParam = mysql_real_escape_string($myParam);
    return $myParam;

and then in each function

public function setMonthlyData($companyID, $userID, $resultArr)
    $myResponseObj = new Object();

    $myCompanyID = $this -> protectMySQL($companyID);  //vet $companyID
    $myUserID = $this -> protectMySQL($userID);        //vet $userID

    //execute query using parameters
    //then return the result 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.