Re: Security scanner
| From: | Richard Lynch | Date: | Thu, 14 Feb 2008 20:28:45 +0000 |
| Subject: | Re: Security scanner | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-269316@lists.php.net to get a copy of this message | ||
On Mon, February 11, 2008 9:27 am, Emil Edeholt wrote:
> Thanks. Sure, I know how to escape and filter the input.. But since
> not
> all my sites use PDO yet, and I use some external code it would be a
> good idea to also use an sql injection scanner.
Scanning for SQL injection is like a "blacklist" approach -- always
bound to be another injection you didn't think of.
Validating the data and using mysql_real_escape_string is the
"whitelist" approach -- You specifically require the data to be of the
correct format, and you get MySQL to delimit it properly as DATA and
not SQL CODE.
--
Some people have a "gift" link here.
Know what I want?
I want you to buy a CD from some indie artist.
http://cdbaby.com/from/lynch
Yeah, I get a buck. So?