Ethical Hacking

13.3    Protection Against SQL Injections

To protect yourself against SQLi, you can take the following countermeasures:

• Only use prepared SQL statements with placeholders (?, $1, :value) instead of dynamic SQL strings. This prevents user input from being interpreted as code.

• Check whether inputs correspond to the expected data type, format, and value range—e.g., only numbers, only email addresses, or only certain characters.

• Never combine user input directly with SQL code, even in special cases such as logs or search queries. Never use string concatenation for SQL commands.

• Ensure that the database user of the web application only has read or write access to the tables they need—and never to administrative functions.

• Disable SQL error ...