SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 347
OleDbConnection con = new OleDbConnection(ConnectionString);
string Sql = "SELECT * FROM users WHERE username=? AND password=?";
cmd = new OleDbCommand(Sql, con);
// Add parameters to SQL query
cmd.Parameters.Add("@username",
// name
OleDbType.VarChar,
// data type
16); // length
cmd.Parameters.Add("@password",
OleDbType.VarChar,
16));
cmd.Parameters.Value["@username"] = username;
cmd.Parameters.Value["@password"] = password;
reader = cmd.ExecuteReader();
// set parameters
// to supplied values
Tip
When using parameterized statements with ADO.NET, it is possible to specify
less or more detail about the statement than I did in the preceding example.
For instance, you can specify just the name and the value in the parameter
constructor. In general, it is a good security practice to specify parameters as
I did, including the data size and type, because this provides an additional level
of coarse-grained validation over the data that is being passed to the database.
Parameterized Statements in PHP
PHP also has a number of frameworks that you can use to access a database. I’ll demonstrate
three of the most common frameworks in this section: the mysqli package for accessing
MySQL databases, the PEAR::MDB2 package (which superseded the popular PEAR::DB
package), and the new PHP Data Objects (PDO) framework, all of which provide facilities
for using parameterized statements.
The mysqli package, available with PHP 5.x and able to access MySQL 4.1 and later
databases, is one of the most commonly used database interfaces, and supports parameterized
statements through the use of placeholder question marks. The following example shows a
parameterized statement using the mysqli package:
$con = new mysqli("localhost", "username", "password", "db");
$sql = "SELECT * FROM users WHERE username=? AND password=?";
$cmd = $con->prepare($sql);