How To Avoid SQL Injection

SQL injections are among the flaws the most widespread and dangerous in PHP.
This tutorial will explain clearly the concept of SQL Injection and how to avoid them once and for all.

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.

There are two types of SQL injection:

* Injection into the variables that contain strings;
* Injection into numeric variables.

These are two very different types and to avoid them, it will act
differently for each of these types.


Imagine a PHP script that fetches the age of a member according to its
nickname. This nickname has gone from one page to another via the URL
(by $ _GET what: p). This script should look like this:

$pseudo = $_GET['pseudo'];
$requete = mysql_query("SELECT age FROM membres WHERE pseudo='$pseudo'");


Well keep you well, this script is a big SQL injection vulnerability.
Suffice it to a bad boy putting in place the username in the URL a query
like this:


' UNION SELECT password FROM membres WHERE id=1



It is to arrive to show (just an example), for example the password for
the member with the id 1. I will not explain in detail the operation for
fear that someone is not nice to walk around. Well, so let us go to the
security:).

II) Security .


To secure this type of injection is simple. You use the function
mysql_real_escape_string ().


This feature adds the "\" character to the following characters:


NULL, \ x00, \ n, \ r, \, ', "and \ X1A


As you have noticed in previous injection, the attacker uses the quote
(to close the 'around $ nick): if she is prevented from doing that, the
bad boy will only have to look elsewhere . This means that if one
applies a mysql_real_escape_string () to the variable name like this ...

$pseudo = mysql_real_escape_string($_GET['pseudo']);
$requete = mysql_query("SELECT age FROM membres WHERE pseudo='$pseudo'");

The application is completely secure.
Explanation

' UNION SELECT password FROM membres WHERE id=1


Well if we apply mysql_real_escape_string () to the variable $ name used
in the query is what will the injection:


\' UNION SELECT password FROM membres WHERE id=1


This means that we do not even come out of assessments around $ nick in
the request because the \ has been added. There is another function
somewhat similar to mysql_real_escape_string () is addslashes (), why
not have used? Well recently, a security hole was discovered on this if
it is used on a PHP 4.3.9 installation with magic_quotes_gpc enabled.

Numeric variables:


This type of injection is less known than the previous one, making it
more frequent, and it starts as just now with an example. This time, it
displays the age of a member according to its id, and by passing it by a
form ($ _POST) to change:

$id = $_POST['id'];
$requete = mysql_query("SELECT age FROM membres WHERE id=$id");


mysql_real_escape_string () would be nothing here, since if an attacker
wants to inject SQL code, it will not need to use quotes, because the
variable $ id is not surrounded by quotes. Simple example of
exploitation:


UNION SELECT password FROM membres WHERE id=1


This injection did exactly the same as the previous one, except that
here, to avoid it, there are two solutions:

* Change the contents of the variable so it contains only numbers;
* Check if the variable actually contains a number before using it in a query.


Method 1:


We'll use a function , intval () This function returns regardless of the
contents of a variable its numerical value. For example:


$variable = '1e10'; // $variable vaut '1e10'
$valeur_numerique = intval($variable); // $valeur_numerique vaut 1


Now back to our sheep:


$id = intval($_POST['id']);
$requete = mysql_query("SELECT age FROM membres WHERE id=$id");
}


That is: you can stop there and is more than enough, but I recommend you
continue to find another method, or you have air beast if you find this
method on a code that is not yours without understand it.


Méthode 2:


Here we use a function that returns TRUE when a variable contains only
numbers and FALSE if it is not the case this function is is_numeric (),
we will use it in a condition that checks whether is_numeric ( ) returns
TRUE well.


$id = $_POST['id'];
if (is_numeric($id))
{
$requete = mysql_query("SELECT age FROM membres WHERE id=$id");
}
else
{
echo "Trying to hack me ? ";


What is the best, depending intval () and is_numeric ()?


Well I will say that they are both equally effective, they are equal.
But I prefer inval () since with is_numeric () write more code, and if
the variable does not contain only numbers, the request is canceled (in
principle, but of course you can run the same query by choosing an
default value for the variable used). Well that's it! You know all about
securing your applications. If you apply these methods, there is
absolutely no risk of having a fault type SQL injection on its website
(or PHP).

Credit Card Hackers Are Here - Have You Checked Your Credit Report Lately?

Credit card hacking has become one of the new security headaches of consumers. Although in face to face transactions the percentage of credit card fraud is almost a tenth of a percent, in online transactions it's as high as two or three percent.
That means that for every one hundred transactions you may do in the internet, you may suffer two or three breaches in your private information. Stopping credit card number hacking is, nowadays, one of the priorities of credit card brands around the world.One funny thing about many of these hackers; free credit card numbers are posted at the internet. Some of them don't want the potential money that can be acquired from this information, only the fame.
How Are Credit Cards Gained By Hackers?
A hacker has many ways to gain a credit card number from an innocent user. The most common one is known as phishing. In this technique, the hacker poses as an officer within an organization, let's say VISA. The hacker sends to a group of email accounts an alert, instructing the receiver to follow determined set of instructions before his credit card is cancelled.If the user is not aware of this kind of fraud, he will insert his credit card number, his name and expiration date without knowing he is going to be a victim of an online crime.Another way for hacking credit card numbers is through a website. The hacker only needs to hack the systems of an online retailer, let's say, Costco, and search for the database where the retailer stores the information of all of the users who have made recent transactions.The third way is through the online process of buying. Let's say an adult finds a website with adult content that he or she finds attractive. It's quite probable that the website is only a masquerade for acquiring credit card information from you.
What Is A Carder?
A carder is a criminal who specializes in stealing information from credit cards. Although the majority of them buy the information from online vendors, some of them are quite savvy on how to access that information by themselves.In the physical world, a carder will steal the information from a user while doing a face to face transaction. The criminal only needs to pass the card through a special scanner. This device will read from the magnetic strip all of the credit card information. Afterwards, the carder will trespass that information to a blank card available in many identity card stores. In the virtual world, credit card hacking is a bit more sophisticated and automatized. A hacker could install inside your system a credit card hacking software known as Bugbear. This program is a keystroke logger; it captures the keys that you have pressed in your keyboard and after some time, it transmits this information to the hacker. The criminal will navigate through this data, searching for any private information that can give him access to your credit card.Besides Bugbear, there is also the IRC bot. This automated software is used for determined functions, like a moderator for a chat room. But if it is used by a hacker, he may use it for stealing your credit card information. The IRC bot will pose as an official from a company, asking you to insert your credit card information. Another mean that hackers use for stealing money from your credit card is through unused ebay accounts. Once they find a possible victim, the hacker uses a program that starts bombarding the account until it breaks it. Once inside, the hacker will use it for posing as the real user, selling equipment that will never reach the buyer once he buys it.
Note: Article Taken From