SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 355
You can use a number of functions in PHP as the basic building blocks for building
input validation, including the following:
■■
preg_match(regex, matchstring) Do a regular expression match with matchstring
using the regular expression regex.
■ ■ is_(input) Check whether the input is ; for example, is_numeric().
■ ■ strlen(input) Check the length of the input.
An example of using preg_match to validate a form parameter could be as follows:
$username = $_POST['username'];
if (!preg_match("/^[a-zA-Z]{8,12}$/D", $username) {
// handle failed validation
}
Encoding Output
In addition to validating input received by the application, it is often necessary to also
encode what is passed between different modules or parts of the application. In the context
of SQL injection, this is applied as requirements to encode, or “quote,” content that is sent
to the database to ensure that it is not treated inappropriately. However, this is not the only
situation in which encoding may be necessary.
An often-unconsidered situation is encoding information that comes from the database,
especially in cases where the data being consumed may not have been strictly validated or
sanitized, or may come from a third-party source. In these cases, although not strictly related
to SQL injection, it is advisable that you consider implementing a similar encoding approach
to prevent other security issues from being presented, such as XSS.
Encoding to the Database
Even in situations where whitelist input validation is used, sometimes content may not
be safe to send to the database, especially if it is to be used in dynamic SQL. For example,
a last name such as O’Boyle is valid, and should be allowed through whitelist input
validation. This name, however, could cause significant problems in situations where this
input is used to dynamically generate an SQL query, such as the following:
String sql = "INSERT INTO names VALUES ('" + fname + "','" + lname + "');"
Additionally, malicious input into the first name field, such as:
',''); DROP TABLE names--
could be used to alter the SQL executed to the following:
INSERT INTO names VALUES ('',''); DROP TABLE names--','');