Sitemap    
  Home Food Photographs IT Parenting Resources Learning  
SECURITY
SQL injection 1
Protect against SQL injection 2
Protect against SQL injection 1
Protect against SQL injection 2

3B. Use Parameterized Queries using PHP and MSSql
<?php
$conn = sqlsrv_connect( $serverName, $connectionInfo);
$strsql = "SELECT FIRST_NM, LAST_NM, DT_OF_BIRTH FROM EMPLOYEE_DTL WHERE FIRST_NM = ? ";
$stmt = sqlsrv_query( $conn, $strsql, array($first_name));
$user_info = sqlsrv_fetch_array( $stmt);
sqlsrv_free_stmt($stmt);
sqlsrv_close( $conn);
?>


3C. Use Parameterized Queries using PHP and MySQL
<?php
$mysqli = new mysqli("localhost", "my_user", "my_password", "db_name");
/* check connection */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}

$first_nm = "From request user input";

/* create a prepared statement */
$stmt =  $mysqli->stmt_init();
if ($stmt->prepare("SELECT FIRST_NM, LAST_NM FROM EMPLOYEE_DTL WHERE FIRST_NM = ? ")) {

    /* bind parameters for markers */
    $stmt->bind_param("s", $first_nm);

    /* execute query */
    $stmt->execute();

    /* bind result variables */
    $stmt->bind_result($FIRST_NM);
    $stmt->bind_result($LAST_NM);

    /* fetch value */
    $stmt->fetch();

    echo("First name: %s and last name: %s\n", $FIRST_NM, $LAST_NM);

    /* close statement */
    $stmt->close();
}

/* close connection */
$mysqli->close();
?>



4. Use different database users for select, insert, delete
Create different database users with different priviledges. Create three different users which have select, insert, update, delete access.
Grant table level access to each user. Access should be excluded unless and untill specified and not other way round.


5. Encrypt passowords before storing in the database
Use single hashing functions SHA1, MD5 to encrypt passwords and then store them in the database. Then always use same function to check user password against one stored in the database. If attacker is able to fetch password using SQL injection still it cannot be used directly.

ADD TO DEL.ICIO.US ADD TO DIGG ADD TO FURL ADD TO REDDIT ADD TO STUMBLEUPON ADD TO TECHNORATI FAVORITES ADD TO SQUIDOO ADD TO YAHOO MYWEB ADD TO ASK ADD TO GOOGLE
Post your comments:
Your Name: 
Security check:
Your Comment: 1500 chars
Latest
How to loop arraylist JAVA6 Syntax
How to iterrate through ArrayList and display multiple rows using for loop JAVA6 syntax..
Java JSP  2010-Oct-12
How to loop arraylist
How to iterrate through ArrayList and display multiple rows using for loop, JSTL tags..
Java JSP  2010-Oct-12
Consumer using JAX WS Dispatch API and DOM parser 1
Access/Consume Webservice using Servlet, JAX-WS Dispatch API dynamic client and parsing SOAP response using DOM parser...
Java Webservice  2010-Sep-20
Simple Java first CXF Webservice 4
Building Simple Java first CXF webservice using CXFServlet, Spring, jaxws:endpoint, @WebService, @SOAPBinding, @WebResult
Java Webservice  2010-Sep-19
Simple Java first CXF Webservice 3
Building Simple Java first CXF webservice using CXFServlet, Spring, jaxws:endpoint, @WebService, @SOAPBinding, @WebResult
Java Webservice  2010-Sep-18
Simple Java first CXF Webservice 1
Building Simple Java first CXF webservice using CXFServlet, Spring, jaxws:endpoint, @WebService, @SOAPBinding, @WebResult
Java Webservice  2010-Sep-18
Simple Java first CXF Webservice 2
Building Simple Java first CXF webservice using CXFServlet, Spring, jaxws:endpoint, @WebService, @SOAPBinding, @WebResult
Java Webservice  2010-Sep-18
Encoding special characters in userinput or on server
Encoding can be done either in Javascript or JAVA encodeURIComponent, escape, java.net.URLEncoder..
Java JSP  2010-Aug-09
Jstl fmt tag i18n formatdate formatcurrency
fmt:setBundle, native2ascii.exe, fmt:message, fmt:setLocale, fmt:formatDate, fmt:formatNumber type=currency..
Java JSP  2010-Aug-05
How to read and write a file
How to read and write a file java.io.BufferedReader,java.io.FileReader, InputStreamReader ...
Java J2SE  2010-Aug-04
jQuery validate form using ajax 2
How to validate/submit form using ajax and jQuery input#, ($.ajax)..
Javascript  2010-Jul-23
jQuery validate form using ajax 1
How to validate/submit form using ajax and jQuery ($.ajax)..
Javascript  2010-Jul-23
How to create datasource in RAD Websphere
Create JDBC provider, datasource and JAAS security setup, JDBC connection URLs
Servers Websphere  2010-Jul-08
Get Started 4
Struts2 framework structure, how various components fit together
Java Struts2  2010-Jul-07
How to populate a form when JSP is called first time
This is achieved throught setting bean in request, using frameworks like Struts2, Spring3..
Java JSP  2010-Jul-07
Spring3 And Hibernate 4
Spring3 and Hibernate 3.5.3 working together @Controller, @RequestMapping, @InitBinder, HibernateTransactionManager, LocalSessionFactoryBean, HibernateTemplate
Java Spring  2010-Jul-07