SQL Injection Attacks and Defense

Chapter 8. Code-Level Defenses

Solutions in this chapter:

▪ Using Parameterized Statements

▪ Validating Input

▪ Encoding Output

▪ Canonicalization

▪ Designing to Avoid the Dangers of SQL Injection

Summary

Solutions Fast Track

Frequently Asked Questions

Introduction

In Chapter 4, Chapter 5, Chapter 6 and Chapter 7, we focused on ways to compromise SQL injection. But how do we fix it? And how do we prevent SQL injection in our applications going forward? Whether you're a developer with an application that is vulnerable to SQL injection, or whether you're a security professional who needs to advise your client, there are a reasonably small number of things that you can do at the code level to reduce or eliminate the threat of SQL injection.

This chapter ...