> Set input validation
The validation process aims to verify the type of input submitted by the user is allowed or not. That way, only values that pass validation can be executed.
Validation should not only be applied to fields that can be inputted. You also need to apply the same as:
- Ensures strong input validation using regular expressions as whitelists for structured data (such as name, age, income, survey responses, zip code).
- for a fixed set of values (such as a drop-down list, radio button, etc.), specify which value is returned. The data entered must exactly match one of the options offered.
> Use parameterized queries
Parameterized queries are a means of pre-compiling SQL statements, so that later you can provide parameters for the statements to be executed. This method allows the database to recognize the code and distinguish it from the input data.
This coding style helps reduce SQL injection attacks. User input is automatically quoted and will not cause a change in destination.
> Installing a filter for metacharacter input
Installing a metacharacter input filter is one way of dealing with the threat of SQL injection. Implements a filter against metacharacters (&, ;, ', ', \, ", |, *, ?, ~, <, >, ^, (, ), [, ], {, }, $,
, and \ r) is useful for preventing input on user forms that can be used to perform SQL injection attacks.
YOU ARE READING
Hacking | Bypass Login (SQL Injection : Basic)
Short StoryFOR EDUCATIONAL PURPOSES ONLY! How to Bypass Authentication with SQL Injection
