Advanced

Protecting your MySQL database from SQL injection attacks with GreenSQL

Posted by Scott_Ruecker on · 5 comments
Linux.com; By Ben Martin 		Mail this story
Print this story

SQL injection attacks can allow hackers to execute arbitrary SQL commands on your database through your Web site. To avoid these attacks, every piece of data supplied by a user on a Web form, through HTTP Post or CGI parameters, or other means, must be validated to not contain information that is not expected. GreenSQL is a firewall for SQL -- it sits between your Web site and MySQL database and decides which SQL statements should and should not be executed. At least that's the idea -- in execution, I found some open doors.

Full Story

  Nav
» Read more about: Story Type: News Story; Groups: Linux, MySQL

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (5)

tracyanne ·
and pass parameters, that gets rid of most the means of SQL injection from the start. There isn't a lot else you need to do after that.
gus3 ·
Good advice. What's the earliest version of MySQL that supports stored procedures?

(Since I'm not a professional DB dev, I've never had reason to use them in my own development, so I don't know.)
jezuch ·
If you don't have stored procedures, try prepared statements. And if you don't have prepared statements... Well, here's a nickel, get yourself a real programming language ;)
Sander_Marechal ·
Just get a proper Database Abstraction layer. If you're writing SQL statement by hand YOU HAVE A BUG!

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post