6

I have a javascript code that access a sqlite3 database. I would like to validate my text field value and prevent SQL injection. Is there an "optimum algorithm" for that?

--update: I'm developing a Xulrunner desktop application. Maybe I should use the database in the xpcom component, which is compiled (written in C), so the user will not have access to it..

Improve this question
4
  • Presumably the Javascript is not accessing the database directly, as Javascript is normally found on the client side. What are you running on your server? Commented Apr 29, 2011 at 20:10
  • dupe? stackoverflow.com/questions/3913837/… Commented Apr 29, 2011 at 20:11
  • Your javascript code is directly accessing the db? Commented Apr 29, 2011 at 20:12
  • @standau ops, sorry, it really answers the question Commented Apr 29, 2011 at 20:25

3 Answers 3

Reset to default
10

Typically SQL injection is avoided using parameterized SQL statements.

Here's an MSDN article describing how you would do this.

Here is another article that describes several ways you can prevent sql injection.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

6

SQL injection prevention is done at the server side, there is nothing you can do on the client side to prevent it.

Improve this answer

3 Comments

Yes, but he's using sqlite3, which I would assume is local rather than on a server.
@Gordon Worley, in this context I would say server side would be inclusive of some form of language like PHP, C#, etc. that cannot be disabled/modified by end user.
@Gordon Worley -You mean he is accessing a database that resides on the client side? Man, that's a concept. Never thought of it.
1

I'm not sure what type of environment you're in, but be aware that because of the nature of JavaScript and the way it's often executed in browsers, etc., code injection attacks are relatively easy, so any validation you do on the client side could be side stepped by anyone who is serious about an attack. Not that you shouldn't validate, just that you should be aware that you need to pay attention to where you're running to know if validation is enough.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.