Tip: Protect your MySQL from SQL Injection
Here's an important tip for everybody using MySQL, you need to set the following option in your my.ini or my.cnf configuration file to prevent SQL injection attacks.
Before you do this, If you have a simple search on your site and a user inserts
instead of just
The \'' will get escaped and your SQL statment will turn from something like:
to something like:
Because -- is the start of a a comment in MySQL, the AND userId = 55 bit will be ignored.
sql-mode=NO_BACKSLASH_ESCAPES
Before you do this, If you have a simple search on your site and a user inserts
test\'' OR 1 = 1 --
instead of just
test
The \'' will get escaped and your SQL statment will turn from something like:
WHERE variable LIKE 'test' AND userId = 55;
to something like:
WHERE variable LIKE 'test' OR 1 = 1 -- AND userId = 55;
Because -- is the start of a a comment in MySQL, the AND userId = 55 bit will be ignored.
Tags:
Comments [2]
Peter Coppinger aka Topper is a neurotic web monster who spends most of his chaotic life developing ColdFusion web applications when not drinking himself into a stupor and scheming his plans for world dominance.
