SQL injection - What is it and how do I prevent it?
summary
Explains that SQL injection happens when user input like "1 OR 1=1" is interpolated into queries and demonstrates fixes: prepared statements and parameter binding for strings and integers, whitelists for ORDER BY/table names, and input validation like is_numeric. Describes detection using PT Query Digest and pt-fingerprint to detect new query fingerprints, a MySQL proxy (know_inject) that enforces a whitelist, logging stack-trace comments into queries, and the MySQL Enterprise Firewall as an option.
AI-written summary · about
chapters (11)
- 0:00SQL injection introduction
- 1:22How SQL injection works
- 3:17Prevent with prepared statements
- 5:05Safe integer parameters
- 6:30Protect dynamic SQL
- 9:01Detect in legacy systems
- 13:03Anomaly detection with PT digest
- 17:41Mitigate after detection
- 19:05Debug with query comments
- 21:14Prevention and monitoring tools
- 22:43Code review for SQL safety
related talks
41mSQL Injection Isn't Dead: Smuggling Queries at the Protocol Level
26mWill it inject? A look at SQL injection and ActiveRecord
54mTaking on the King: Killing Injection Vulnerabilities
33mWill It Inject? A Look at SQL injections and ActiveRecord
22mSecure Your Code — Injections and Logging
38mInjections - 4 Ways of Penetration
44mEnding Injection Vulnerabilities
48mEnding Injection Vulnerabilities