SQL injection is a type of computer attack that consists of the infiltration of intrusive code within the statements/queries to be executed in the database. This infiltration usually occurs through parameters passed by users to a program or through a web form.

The target of the intrusion is usually malicious and can cause significant damage: data disclosure, content modification, identity theft, deletion and destruction of data or structures within the database...

Many programmers assume that users will always enter valid data and that queries will therefore be reliable, and they do not take special measures when putting together statements that they execute in the database. That makes your applications vulnerable to these kinds of attacks.

EXAMPLE : Imagine that you have a web page with a form to update user data in your database, but you don't sanitize those entries before using them. In PHP you could have something like this:

 $sql = "UPDATE usuarios SET nombre = '".$_POST["nombre"]."' WHERE id = ".$_POST["id"];

Now imagine that the malicious user writes that his name is Pepito' WHERE 1=1;-- . Your SQL statement will look like this:


UPDATE usuarios SET nombre = 'Pepito' WHERE 1=1;--' WHERE id = 123

The -- characters indicate that what follows is a comment and is ignored in the database, so what is executed is simply this:

 UPDATE usuarios SET nombre = 'Pepito' WHERE 1=1;

The malicious user has injected SQL code and has made all users in your database named Jim from now on. If you also allow multiple statements at the same time, the malicious user could pass something like '; DROP TABLE usuarios;-- and drop the entire table.

How can I prevent SQL injection?

To avoid SQL injection, just follow a simple series of guidelines:

• Always DISTRUST user input . Pre-process, sanitize, or test them, but never use them directly. You should always assume that the user is going to try to attack your database; We like to think that all users are good people, but a single malicious user is enough to destroy everything.

• AVOID dynamic SQL . They are the most common error when executing statements to the database and are what malicious users take advantage of to attack your code. The solution is easy: don't concatenate the SQL query with the user input, and instead

• DO use prepared statements (also called parameterized). They offer a more efficient and less error-prone strategy. In addition, all major modern database systems support prepared statements with bound variables.

• LIMIT access to the database . Do not use superusers (root) but users with custom/limited access to the database (although this is not always within the reach of all developers).

• MODERNIZE your code . Keep your code up to date in terms of security, do not use obsolete or non-recommended methods. There are reasons why they are obsolete.

  For example, a frequently seen upgrade-related bug on StackOverflow is the particular case of PHP and the mysql_* functions, which should be avoided and use MySQLi ( mysqli_* ) or PDO instead. For more information on that topic, read the question How to prevent SQL injection in PHP?