Re: sql injections/best practises

Thank you Christopher - this gives me some much needed direction. --- On Fri, 11/7/08, Christopher Jones <christopher.jones@oracle.com> wrote: From: Christopher Jones <christopher.jones@oracle.com> Subject: Re: [PHP-DB] sql injections/best practises To: fmh102560@yahoo.com Cc: php-db@lists.php.net Date: Friday, November 7, 2008, 5:39 PM mignon hunter wrote: > I'm am trying to find some definitive best practises on database connections with php on both mysql and oracle. > > I'm starting to redesign a corporate website and am trying to find out more about security and the best practises for database queries and user input form handling. > > For example - what's the best usage - prepared statements? And does it have to be php 5? I need preferably a one stop shop as opposed to looking at dozens of different places. Can you advise a particular book? Website? > > I have checked out the security area on the php manual and some users notes - some were useful. But it didnt really have a lot of info and I dont think it is comprehenive or all inclusive. > > Thanks in advance. PS I would like to switch the current site from jsp to php. I was going to look into Zend IDE. Comments? Suggestions? > > thanks PHP 5.2 is the way to go for new projects: PHP 4 isn't being maintained. Binding/preparing statements is the way to go. Here are quotes about them with MySQL & Oracle "They are useful for speeding up execution when you are performing large numbers of the same query with different data. They also protect against SQL injection-style attacks." (From "PHP and MySQL Web Development", 4th Edition, Luke Welling and Laura Thomson) "If I were to write a book about how to build nonscalable [note the NON] Oracle applications, then 'Don't Use Bind Variables' would be the title of the first and last chapters. [...] If you want to make Oracle run slowly [...] just refuse to use bind variables" (From "Expert Oracle Database Architecture", Tom Kyte) Depending on the site needs, consider a DB abstraction layer or a framework. For high performance connections in PHP OCI8 for Oracle, use oci_pconnect() and pass the character set. There are a number of Oracle-PHP books available. One free, introductory one is the "Underground PHP & Oracle Manual", http://tinyurl.com/f8jad (A new edition will be released in the next couple of weeks) Chris -- Email: christopher.jones@oracle.com Tel: +1 650 506 8630 Twitter: http://twitter.com/ghrd Free PHP Book: http://tinyurl.com/f8jad