SQL Injection Myths & Fallacies: Best practices of defense

What people said

Strong rec Average Joe · 2012-02 · Stack Overflow · on “SQL Injection in a Disguise”

@Bill: I watched your video [this video] on SQL Injection, a couple of times already. Best talk I've ever seen on this particular subject. an eye opener... Do you have any other links leading to other security/programming talks you've been involved?

Recommends Average Joe · 2012-12 · Stack Overflow · on “Not Escaping quotes properly while using AJAX”

That is true. In his case, he is lucky that he got an error. Many flaws like that may go undetected and that's one of the reasons why SQL Injection is still an issue after all the PDO talk as far as safety. This is an eye opener > [this video]

Recommends Bill Karwin · 2014-11 · Stack Overflow · on “php input test / mysql_real_escape_string / pdo”

You can't use ext/mysql functions with an ext/mysqli connection. You must use one or the other for both the connection and the escaping. The equivalent PDO method is PDO::quote() [LINK] , but be aware this adds single-quotes to each end of the string, unlike the escape-string functions of the older mysql extensions. All this is moot because it's unnecessary to sanitize inputs if you use prepared statements and add variables into queries using query parameters. In fact, you must not escape strings if you pass them as query parameters, because you'll get literal backslashes inserted into your database where you didn't want them. See lots of good examples and discussion here: How can I prevent

Cites GEMI · 2011-11 · Stack Overflow · on “Is this secure? ADOdb prepared statements”

I do not understand why nobody tried to answer this, or even comment in any way. SO works in mysterious ways I guess.. ;) Anyhow, I have researched enough (I think so) to be able to answer this myself, with a certain degree of confidence. So in essence prepared queries are much safer than just input escaping such as mysql_real_escape_string(); , because as some wise people have said: Yes, mysql_real_escape_string is effectively just a string escaping function. It is not a magic bullet. All it will do is escape dangerous characters in order that they can be safe to use in a single query string. However, if you do not sanitize your inputs beforehand, then you will be vulnerable to certain atta

Cites Ilia Ross · 2012-08 · Stack Overflow · on “SQL injections in ADOdb and general website security”

I've been investigating thoroughly on this subject recently and would like to share with others quite interesting material, thus, making my question more complete and instructive for everyone. Preventing SQL Injection with PHP by John Nebel [LINK] Security Corner - SQL Injection by Chris Shiflett [LINK] The Unexpected SQL Injection by Alexander Andonov [LINK] Mysql_real_escape_string() versus Prepared Statements by Ilia Alshanetsky [LINK] SQL Injection Attack and Defense by Sagar Joshi [LINK] SQL Injection Attacks by Prof. Jim Whitehead [LINK] addslashes() vs mysql_real_escape_string() by Chris Shiflett [LINK] What's a SQL Injection Bug by Joel Spolsky [LINK] MySQL - SQL injection prevention

Cites Bill Karwin · 2014-05 · Stack Overflow · on “Old messy PHP code and MySQL injections”

There is no one-size-fits-all solution to SQL injection. If there were, they would build that into every programming language and framework, and then SQL injection would cease to be a problem. They tried that with magic-quotes but it didn't work out and that feature is now deprecated. See my presentation SQL Injection Myths and Fallacies [LINK] for more details on methods of protection. If you want to honor this old project, I suggest taking some screenshots of it and posting them as static images. Bill, do you have a lecture, based on that presentation? You can view this as a webinar here (free but requires registration): [LINK] And I also presented it at the San Francisco MySQL Meetup: [VI