Group items tagged

Filter: All | Bookmarks | Topics Simple Middle

shared by kuni katsuya on 09 Aug 12 - No Cached

SQL Injection Prevention Cheat Sheet
...

Cancel
it is EXTREMELY simple to avoid SQL Injection vulnerabilities in your code.
...

Cancel
create dynamic database queries that include user supplied input
...

Cancel
...19 more annotations...
a) stop writing dynamic queries
...

Cancel
b) prevent user supplied input which contains malicious SQL from affecting the logic of the executed query
...

Cancel
Primary Defenses:
...

Cancel
Option #1: Use of Prepared Statements (Parameterized Queries)
...

Cancel
Option #3: Escaping all User Supplied Input
...

Cancel
Additional Defenses:
...

Cancel
Enforce: Least Privilege
- kuni katsuya on 21 Sep 12
  
  least privilege should be *required*, included as a primary defense
  
  <div class="cArrow"> </div><div class="cContentInner">least privilege should be *required*, included as a primary defense</div>
  
  ...
  
  Cancel
...

Cancel
Perform: White List Input Validation
...

Cancel
Primary Defenses
...

Cancel
Defense Option 1: Prepared Statements (Parameterized Queries)
...

Cancel
attacker is not able to
...

Cancel
change the intent
...

Cancel
of a query, even if SQL commands are inserted by an attacker
...

Cancel
allows the database to
...

Cancel
distinguish
...

Cancel
between
...

Cancel
data,
...

Cancel
code a
...

Cancel
Defense Option 3: Escaping All User Supplied Input
...

Cancel

shared by kuni katsuya on 21 Sep 12 - No Cached

SQL Injection
...

Cancel
"injection" of a SQL query via the input data from the client to the application
...

Cancel
exploit can
...

Cancel
...18 more annotations...
read sensitive data
...

Cancel
modify database data
...

Cancel
execute administration operations
...

Cancel
SQL injection errors occur when:
...

Cancel
Data enters a program from an
...

Cancel
untrusted source
...

Cancel
The data used to
...

Cancel
dynamically construct a SQL query
...

Cancel
consequences are:
...

Cancel
Confidentiality:
...

Cancel
sensitive data
...

Cancel
Authentication
...

Cancel
user names and passwords
...

Cancel
Authorization
...

Cancel
change this information
...

Cancel
Integrity
...

Cancel
read sensitive information
...

Cancel
changes or even delete this information
...

Cancel

shared by kuni katsuya on 21 Sep 12 - No Cached

Preventing SQL Injection in Java
...

Cancel
inject (or execute) SQL commands within an application
...

Cancel
Defense Strategy
...

Cancel
...19 more annotations...
To prevent SQL injection:
...

Cancel
All queries should be
...

Cancel
parametrized
...

Cancel
All dynamic data
...

Cancel
should be
...

Cancel
explicitly bound to parametrized queries
...

Cancel
String concatenation
...

Cancel
should never be used
...

Cancel
to create dynamic SQL
...

Cancel
OWASP SQL Injection Prevention Cheat Sheet.
...

Cancel
Parameterized Queries
...

Cancel
Prepared Statements
...

Cancel
automatically be escaped by the JDBC driver
...

Cancel
userId = ?
...

Cancel
PreparedStatement
...

Cancel
setString
...

Cancel
Dynamic Queries via String Concatenation
...

Cancel
never construct SQL statements using string concatenation of unchecked input values
...

Cancel
dynamic queries via the java.sql.Statement class leads to SQL Injection
...

Cancel

shared by kuni katsuya on 21 Sep 12 - No Cached

Least privilege connections
...

Cancel
Always use accounts with the
...

Cancel
minimum privilege necessary
- kuni katsuya on 21 Sep 12
  
  yet another reason why shared db logins (eg. etl_update) are a *BAD IDEA* ie. a set of apps using the same db login are effectively granted the 'highest common denominator' of db privileges, so have more access than they should (eg. update/delete privilege on tables unrelated to app)
  
  <div class="cArrow"> </div><div class="cContentInner">yet another reason why shared db logins (eg. etl_update) are a *BAD IDEA* ie. a set of apps using the same db login are effectively granted the 'highest common denominator' of db privileges, so have more access than they should (eg. update/delete privilege on tables unrelated to app)</div>
  
  ...
  
  Cancel
...

Cancel
...9 more annotations...
for the application
...

Cancel
Parameterized Queries with Bound Parameters
...

Cancel
keep the
...

Cancel
query
...

Cancel
d data
...

Cancel
separate through the use of placeholders known as "bound" parameters
...

Cancel
how to Review Code for SQL Injection Vulnerabilities.
...

Cancel
Guide to SQL Injection
...

Cancel
"injection" of a SQL query via the input data from the client to the application
...

Cancel

1 - 4 of 4

Showing 20▼ items per page