Hardening PHP: SQL injection - Complete walkthrough
Below are the slides from the presentation I gave on SQL injection at last year's OWASP Poland Chapter
meeting. The materials teach how to use prepared statements, how to
escape and write secure stored procedures. Many PHP projects are covered
- PDO, Propel, Doctrine, Zend Framework and MDB2.
Multiple gotchas and caveats are included. I discuss why escaping is
usually the wrong choice, which practices to avoid or follow and how
stored procedures sometimes offer no protection at all.
I tried to make this as complete as possible, so a PHP developer could learn how to protect his applications no matter what framework / database he uses.
Published at DZone with permission of Krzysztof Kotowicz , author and DZone MVB. (source)I tried to make this as complete as possible, so a PHP developer could learn how to protect his applications no matter what framework / database he uses.
English version
(Note: Opinions expressed in this article and its replies are the opinions of their respective authors and not those of DZone, Inc.)
