SQL Injection Attacks and Defense - 2009

348 Chapter 8 • Code-Level Defenses
// Add parameters to SQL query
$cmd->bind_param("ss", $username, $password); // bind parameters as strings
$cmd->execute();
The PEAR::MDB2 package is a widely used and vendor-independent framework for
accessing databases. MDB2 supports named parameters using the colon character and using
placeholder question marks. The following example demonstrates the use of MDB2 with
placeholder question marks to build a parameterized statement. Note that the data and types
are passed in as an array which maps to the placeholders in the query.
$mdb2 =& MDB2::factory($dsn);
$sql = "SELECT * FROM users WHERE username=? AND password=?";
$types = array('text', 'text');
// set data types
$cmd = $mdb2->prepare($sql, $types, MDB2_PREPARE_MANIP);
$data = array($username, $password);
$result = $cmd->execute($data);
// parameters to be passed
The PDO package, which is included with PHP 5.1 and later, is an object-oriented
vendor-independent data layer for accessing databases. PDO supports both named parameters
using the colon character and the use of placeholder question marks. The following example
demonstrates the use of PDO with named parameters to build a parameterized statement:
$sql = "SELECT * FROM users WHERE username=:username AND" +
"password=:password";
$stmt = $dbh->prepare($sql);
// bind values and data types
$stmt->bindParam(':username', $username, PDO::PARAM_STR, 12);
$stmt->bindParam(':password', $password, PDO::PARAM_STR, 12);
$stmt->execute();
Parameterized Statements in PL/SQL
Oracle PL/SQL offers also the possibility of using parameterized queries in database-level
code. PL/SQL supports binding parameters using the colon character with an index
(e.g., :1). The following example demonstrates the use of PL/SQL with bound parameters
to build a parameterized statement in an anonymous PL/SQL block:
DECLARE
username varchar2(32);
password varchar2(32);
result integer;
BEGIN