flawopen.com/sql-injection/Php

इस पेज के मुख्य शब्द

Web Application Security

सुरक्षा अवधारणा (Web Application Security): Core architecture component affected by CWE-89.

CWE-89

सुरक्षा अवधारणा (CWE-89): Standard Common Weakness Enumeration classification for sql-injection-php.

Defense-in-Depth

सुरक्षा अवधारणा (Defense-in-Depth): Multi-layered engineering verification and runtime boundary isolation.

हमले का चरण-दर-चरण प्रवाह

सोर्स कोड: कमज़ोर बनाम सुरक्षित कार्यान्वयन

// $_GET value straight into the query
$query = "SELECT * FROM users
  WHERE id = " . $_GET['id'];
$result = $mysqli->query($query);

// value is bound, never concatenated
$stmt = $pdo->prepare(
  "SELECT * FROM users WHERE id = :id"
);
$stmt->execute(['id' => $_GET['id']]);
$result = $stmt->fetch();

इंजीनियरिंग और सिस्टम सुरक्षा चेकलिस्ट

• ✓हमेशा PDO or mysqli prepared statements for every query touching a variable का उपयोग करें।
• ✓कभी भी rely on addslashes() or manual escaping as the primary defense न करें।
• ✓अनुशंसित सुरक्षा नियम: Replace any remaining mysql_* function calls — they have no parameter binding at all।
• ✓a taint-analysis static check in CI to catch regressions automatically चलाएं।

References

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• PHP Manual — PDO Prepared Statements
• PHP Manual — mysqli Prepared Statements
• OWASP SQL इंजेक्शन रोकथाम चीट शीट