Use PHP program settings to prevent MySQL injection or HTML form abuse

The intention of MySQL injection is to take over the website database and steal information. Common open-source databases, such as MySQL, have been used by many website developers to store important information, such as passwords, personal information and management information.

MySQL is popular because it is used with the most popular server-side scripting language PHP. Moreover, PHP is the main language of the Internet-dominated Linux-Apache server. Therefore, this means that hackers can easily use PHP like Windows spyware.

Hackers enter a large amount of malicious code into an unsecured webpage form (through the drop-down menu, search box, contact form, Query Form and check box ).

Malicious Code will be sent to the MySQL database and then "injected ". To view this process, consider the following basic MySQL SELECT query statements:

SELECT * FROM xmen WHERE username = wolverine

This query requests the database of the "xmen" table to return data with the username "wolverine" in MySQL.

In a Web form, the user enters wolverine and the data is then transmitted to MySQL for query.

If the input is invalid, the hacker has other methods to control the database, such as setting the User Name:

OR =

You may think that normal PHP and MySQL syntax execution input is safe, because whenever someone inputs malicious code, they will get an "invalid query" message, but this is not the case. Hackers are smart, and any security vulnerability cannot be easily corrected because it involves database clearance and resetting management permissions.

The following are two common misunderstandings about MySQL injection attacks:

1. The Network Administrator deems that malicious injection can be used to clean up anti-virus software or anti-spyware. The fact is that this type of infection exploits the weakness of the MySQL database. It cannot be simply deleted by any anti-spyware or anti-virus program.

2. MySQL injection is caused by copying files infected from another server or external sources. This is not the case. This type of infection is caused by someone entering malicious code into the website unprotected form and then accessing the database. MySQL injection can be cleared by deleting malicious scripts instead of using anti-virus programs.

User input verification process

Back up a clean database and place it outside the server. Output a MySQL table and save it on the desktop.

Go to the server and temporarily close the form input. This means that the form cannot process data and the website is closed.

Then start the cleanup process. First, clean up the chaotic MySQL injection on your server. Change the passwords of all databases, FTP and websites.

In the worst case, if you are too late to clean up, you can check the hidden programs running on your server again. These hidden programs are Trojans installed by hackers. Delete it and change all FTP permissions. Scan all Trojans and malware on the server.

When you modify the PHP script program, the form data is processed. A good way to prevent MySQL injection is to trust user data. User input verification is very important to prevent MySQL injection.

Design a filter to filter user input. The following are some tips:

1. Numbers are entered in the form. You can verify whether it is a number by testing whether it is equal to or greater than 0.001 (assuming you do not accept a zero.

2. If it is an Email address. Verify that it consists of allowed character combinations, such as @, A-Z, a-z, or some numbers.

3. for personal names or user names. You can verify whether it contains any illegal characters, such as and *. It is a malicious character that can be used for SQL injection.

Verify numeric Input

The following script verifies whether to enter a valid number ranging from 0.001 to an infinite number. It is worth mentioning that in a PHP program, numbers within a certain range can even be used. Use this verification script to ensure that only a number is entered into the form.

Suppose there are three numeric variables in the program; you need to verify them, we will name them num1, num2 and num3:

// Validate numerical input
If ($ _ POST [num1]> = 0.001 & $ _ POST [num2]> = 0.001 & $ _ POST [num3]> = 0.001 ){

} Else {

}

?>
 

The And condition can be extended to accommodate more than three numbers. Therefore, if you have 10, you only need to extend the AND statement.

This can be used to verify a form that only accepts numbers, such as the contract quantity, license number, and telephone number.

Verification text and email address input

The following form inputs can be used to verify user names, names, and email addresses:

// Validate text input
If (! Preg_match (/^ [-a-z.-@, s] * $/I, $ _ POST [name]) {

}

Elseif ($ empty = 0 ){

} Else {

}

?>
 

One advantage of this verification script is that it does not accept blank input. Some malicious users also use the blank space to manipulate the database. Use the above script to verify only one text variable, "$ name ". This means that if there are three literal variables, you can set a validation script for each variable separately to ensure that each variable passes the review before entering the database.