What is in SQL injection? How can I prevent SQL injection in PHP? Prevent SQL Injection Attacks

Title: What is in SQL injection? How can I prevent SQL injection in PHP? Prevent SQL Injection Attacks

Related Questions:
What is in SQL injection?
How does SQL injection work?
What is SQL injection solution?
How is SQL injection prevention?
How to Prevent SQL Injection Attacks?
How can I prevent SQL injection in PHP?
Different ways to prevent SQL Injection in PHP?
SQL Injection Attacks Prevention System Technology.
Prevent SQL injection vulnerabilities in PHP applications.

Keywords:
SQL injection, SQL injection in PHP, How to prevent SQL injection, Website security, Ways to prevent SQL Injection, SQL injection vulnerabilities, SQL query, Prevent SQL Injection Attacks, Unsafe Input, Correctly formatted SQL statement

Description: The correct way to avoid SQL injection attacks, no matter which database you use, is to separate the data from SQL, so that data stays data and will never be interpreted as commands by the SQL parser. It is possible to create SQL statement with correctly formatted data parts, but if you don't fully understand the details, you should always use prepared statements and parameterized queries. These are SQL statements that are sent to and parsed by the database server separately from any parameters. This way it is impossible for an attacker to inject malicious SQL.

Example: If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example:

$uv = $_POST['user_input'];
mysql_query("INSERT INTO `table` (`column`) VALUES ('$uv')");

That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:

INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')
'Sarah'; DELETE FROM employees

Solution: You basically have few options to achieve this. If you use mysql_real_escape_string().

Recommended solution 1: If you use PDO (for any supported database driver)

$stmt = $pdo-&gtprepare('SELECT * FROM employees WHERE name = :name');
$stmt-&gtexecute([ 'name' =&gt $name ]);
foreach ($stmt as $row) {
// Do something with $row
}

$stmt = $conn-&gtprepare("INSERT INTO tbl VALUES(:id, :name)");
$stmt-&gtbindValue(':id', $id);
$stmt-&gtbindValue(':name', $name);
$stmt-&gtexecute();

Recommended solution 2: If you use MySQLi (for MySQL):

$stmt = $dbConnection-&gtprepare('SELECT * FROM employees WHERE name = ?');
$stmt-&gtbind_param('s', $name); // 's' specifies the variable type =&gt 'string'
$stmt-&gtexecute();
$result = $stmt-&gtget_result();
while ($row = $result-&gtfetch_assoc()) {
// Do something with $row
}


Correctly setting up the connection
Note that when using PDO to access a MySQL database real prepared statements are not used by default. To fix this you have to disable the emulation of prepared statements. An example of creating a connection using PDO is:

$dc = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'password');
$dc-&gtsetAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$dc-&gtsetAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);


In the above example the error mode isn't strictly necessary, but it is advised to add it. This way the script will not stop with a Fatal Error when something goes wrong. And it gives the developer the chance to catch any error(s) which are thrown as PDOExceptions. What is mandatory, however, is the first setAttribute() line, which tells PDO to disable emulated prepared statements and use real prepared statements. This makes sure the statement and the values aren't parsed by PHP before sending it to the MySQL server (giving a possible attacker no chance to inject malicious SQL). Although you can set the charset in the options of the constructor, it's important to note that 'older' versions of PHP (before 5.3.6) silently ignored the charset parameter in the DSN.

$ps = $db-&gtprepare('INSERT INTO table (column) VALUES (:column)');
$ps-&gtexecute([ 'column' =&gt $unsafeValue ]);

$mysqli = new mysqli("server", "username", "password", "database_name");
$unsafe_variable = $_POST["user-input"];
$stmt = $mysqli-&gtprepare("INSERT INTO table (column) VALUES (?)");
// "s" means the database expects a string
$stmt-&gtbind_param("s", $unsafe_variable);
$stmt-&gtexecute();
$stmt-&gtclose();
$mysqli-&gtclose();

References:
https://www.php.net/manual/en/book.mysqli.php
https://www.php.net/manual/en/book.pdo.php
https://www.php.net/manual/en/function.pg-prepare.php
https://www.php.net/manual/en/function.pg-execute.php
https://www.php.net/manual/en/function.mysql-real-escape-string.php
https://www.php.net/manual/en/function.mysql-query.php