Learn sql injection

[makvanpor2000]

HI GUYS
any body know any thing about sql injection, i really like to learn about it,
guys lets all talk about this topic

i got a pdf file about it

http://packetstorm.linuxsecurity.com/papers/bypass/sql-inject.pdf

[mr_lash]

hmmmmmm

wy bring this up in the 1st place?

[makvanpor2000]

some one is hacking me

the reason why i bring up this topic cos some one is hacking into my database, and i want to hack back into his

[something else]

if someone is hacking on your site via sql injection dont you think they would cover there own site against it?

..... kinda pointless ?

[opticalpigion]

the reason why i bring up this topic cos some one is hacking into my database, and i want to hack back into his

RewriteCond %{QUERY_STRING} [^a-z](declare|char|set|cast|convert|delete|drop|exec|insert|meta|script|select|truncate|update)[^a-z] [NC] 
RewriteRule (.*) - [F]

add this into ur .htaccess

[paramound]

don't hack back since you are a new coder, just chillout. Hacking is bad just learn preventive measures

[GiLL]

Prevention from Sql Injection Attack in PHP

To avoid the sql injection attack, please follow the following simple mechanisms in PHP

1) Always restrict the length of the fields of form such as don’t allow more than 20 characters in the fields like username and password with the “maxlength” property available in the html form.

2) Always validate for the proper input like weather the value is valid email or not, is numeric or not , valid date or not etc.

3) Finally, Always use mysql_real_escape_string() function before sending the variable to the SQL query, it ad. For example
note you must be connected to the database for using this function

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

if a intruder inject ‘ OR 1 in the user name and password field then the value of the $username and $password will become \’ OR 1 which is not going to harm us anymore.



this might also help some one
.htaccess

# Block out any script trying to set a mosConfig value through the URL

RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]

# Block out any script trying to base64_encode crap to send via URL

RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]

# Block out any script that includes a <script> tag in URL

RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]

# Block out any script trying to set a PHP GLOBALS variable via URL

RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

# Block out any script trying to modify a _REQUEST variable via URL

RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

# Send all blocked request to homepage with 403 Forbidden error!

RewriteRule ^(.*)$ index.php [F,L]

[kei_ki7]

Prevention from Sql Injection Attack in PHP

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

# Block out any script trying to set a mosConfig value through the URL

RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]

# Block out any script trying to base64_encode crap to send via URL

RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]

# Block out any script that includes a <script> tag in URL

RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]

# Block out any script trying to set a PHP GLOBALS variable via URL

RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

# Block out any script trying to modify a _REQUEST variable via URL

RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})

# Send all blocked request to homepage with 403 Forbidden error!

RewriteRule ^(.*)$ index.php [F,L]

where do i need to put that htaccess?
i mean the .htaccess file

[ranzit2]

where do i need to put that htaccess?
i mean the .htaccess file

in the folder where ur script is.

[youngbobby]

Hi thanks for the help. It was really helpful. But if u have time, u can also tutor on how to validate email field apart from using mysql_real_escape_string(); function

[metulj]

Prevention from Sql Injection Attack in PHP

To avoid the sql injection attack, please follow the following simple mechanisms in PHP

1) Always restrict the length of the fields of form such as don’t allow more than 20 characters in the fields like username and password with the “maxlength” property available in the html form.

2) Always validate for the proper input like weather the value is valid email or not, is numeric or not , valid date or not etc.

3) Finally, Always use mysql_real_escape_string() function before sending the variable to the SQL query, it ad. For example
note you must be connected to the database for using this function

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

@$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
@$password = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['password']))); 

this should be pretty much better

[makvanpor2000]

don't hack back since you are a new coder, just chillout. Hacking is bad just learn preventive measures

u better dont deviate from the topic cause am not a new bie here as u can see am a senior member here,

[manavworld]

Whts sql_injection, its a reason 4 hack our site? Wot we can do for security of our site, last day sm1 hack mah site, and may be he used mah pasword also, hw is it posible even i was change my pasworld last evening? Am very confused about it, can any one tell me how to that hacker enter mah site nd how he get mah pasword?

[CreativityKills]

Lmao, sql injection simply means: i dnt need ur password to **** with ur application lmao

[manavworld]

Than hw we can protact our site from hacking? ..and whr i can put this code...mysql_real_escape_string(strip_tags....i wana to protact my site only to sql injection...hw i can do it...plz help me...plz