Filter URL Query Strings For SQL Injections - PHP

Question

I've been given a site to fix that was recently hacked using SQL injection. From what I can gather the Havij automated SQL injector was used to insert code into the query string parameters of the url.

The site is a custom CMS build and a bit dated. I don't think a full rebuild is likely.

What's the best way to prevent this from occurring again? I'm a PHP developer, but usually just do validations on forms, or use systems that have this functionality already built in - wordpress, codeigniter, drupal etc.

Any ideas or thoughts are appreciated.

Thanks

zerkms · Accepted Answer · 2011-01-05 13:41:03Z

3

There is only one simple rule: every variable (doesn't matter where it came from - from user or it is something already gotten from database) that is being put into the sql query should be sanitized with mysql_real_escape_string() before.

Or you could use prepared queries (prepared statements/placeholders), doesn't matter.

edited Jan 5, 2011 at 13:41

answered Jan 5, 2011 at 13:27

zerkms

256k73 gold badges447 silver badges551 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

ircmaxell Over a year ago

Well, any quoted variable (strings). Don't run MRES on integers and floats, just cast them to that before adding it to the query: ' AND id = ' . (int) $id

zerkms Over a year ago

@ircmaxell: indeed, just did not want to make things complex for OP.

Robimp Over a year ago

Yeah the simple answer is more my cup of tea. Thanks all the same @ircmaxell

AntonioCS · Accepted Answer · 2011-01-05 13:40:41Z

2

You may not be able to change all of the code, but maybe you can change the database code. If so try using PDO and prepared statements. I recommend pdo because you didn't specify the database type. If you are using mysql, I think mysqli also provides prepared statements.

answered Jan 5, 2011 at 13:40

AntonioCS

8,49618 gold badges68 silver badges95 bronze badges

1 Comment

Robimp Over a year ago

Yeah I just used the mysql_real_escape_string() function on the variable before it went to the database. Less stessful / work than i thought it was going to be. Thanks for the answer.

alixcol · Accepted Answer · 2019-06-11 08:42:44Z

0

$url = filter_var($url, FILTER_SANITIZE_URL);

answered Jun 11, 2019 at 8:42

alixcol

691 silver badge5 bronze badges

Collectives™ on Stack Overflow

Filter URL Query Strings For SQL Injections - PHP

3 Answers 3

3 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related