injection

Tagged

A collection of 2 posts

Injections, SQL and otherwise - Basic Security Part 4

NB: This is the fourth post in a series of posts on web application security. SQL Injection SQL injection is a vector that lets a user insert their own SQL into a statement sent to your database server. The typical example is: 1. "SELECT * FROM users WHERE username = ‘" + username + "’ AND

attack

Responsible SQL: How to Authenticate Users

Most SQL-injection articles set a horrible example for young programmers. Here is a very typical “bad example” of why you need to escape user data before it goes into SQL queries: (ed. The symbol « is a line break that’s not in the real code.) 1. $username = $_POST[‘username’]; // username=