Friday, March 19, 2010

Hardening PHP: SQL injection - Complete walkthrough

Below are the slides from the presentation I recently gave on SQL injection on OWASP Poland Chapter meeting. The materials teach how to use prepared statements, how to escape and write secure stored procedures. Many PHP projects are covered - PDO, Propel, Doctrine, Zend Framework and MDB2. Multiple gotchas and caveats are included. I discuss why escaping is usually the wrong choice, which practices to avoid or follow and how stored procedures sometimes offer no protection at all.

I tried to make this as complete as possible, so a PHP developer could learn how to protect his applications no matter what framework / database he uses.


English version

SQL Injection: complete walkthrough (not only) for PHP developers

Polish version

Kompletny przewodnik po SQL injection dla developerów PHP (i nie tylko)

You could also watch video recorded from the presentation. There are already some comments on the slides on niebezpiecznik.pl (Polish), but of course feel free to add comment here.
at

1 comment:

  1. Kibo WintersOctober 31, 2012 at 10:45 AM

    SQL injection is a value injection strategy that uses a protection weeknesses in a site's application. SQL injection is mostly known as an attack vector for sites but can be used to attack any kind of SQL data source

    ReplyDelete