tealise / Bitcraft-Core

The Core Framework
0 stars 0 forks source link

SQL Injection #1

Closed ghost closed 7 years ago

ghost commented 8 years ago

I want us to implement a way early on to prevent any security breach. We either need to make our DALI function super dynamic to handle the SQL string or allow the DALI to just return what's needed for the query when we call the function.

The solution I found for SQL injection is to :

  1. Use JavaScript -> If we can catch it browser side, the better the UX and less processing we have to do.
  2. Use Prepared Statements -> This is what requires what I mentioned above. http://www.w3schools.com/php/php_mysql_prepared_statements.asp