MySQL database security?

I

Ice Cube

Registered Member
Joined
Aug 18, 2011
Messages
57
Reaction score
2
hey guys i was wondering how can i make my MySQL database safe from SQL injections and XSS exploits.
 
Advertise on BHW
A bunch of different ways. If you are writing a custom app you can control permissions to record inserts, not allow different characters to be inserted and unless you need other people to insert data, don't. Not allowing $_GET and only using $_POST will help as well.
 
Random question. me and my friend know nothing about MySql or anything but recently bought a site that uses it. He needed to change some files and insert my password for the server or something. It's not possible for others to see this file, right?
 
Any easier way to do it for someone like me with 0 coding experiance?
 
Without coding nope.
Best answer for php would be PHP 5.3.0 and above mysql_real_escape_string();
 
How can we apply this for wordpress blog databases?

I have been hacked before and it sucks. :(
 
This is a wordpress plugin..i have it...let me chekc teh dns list but if its not on there..i i will upload it shortly
 
The only way to be 100% bulletproof against SQL injections is usin mysql prepared statements.

mysql_real_escape_string works in the most cases too, but its not bulletproof.
 
gbjrO




Code: 
http://www.virustotal.com/file-scan/report.html?id=6193aa0309ea4f3171636d2336e752ccffa0f5e1f22c21abf96edf4d66589326-1326320601
File name:
security-*****.7z
Submission date:
2012-01-11 22:23:21 (UTC)
Current status:
finished
Result:
0/ 43 (0.0%)


Download link:
http://www.multiupload.com/XOEB9R7W46
 
Last edited:
BlueZero said:
The only way to be 100% bulletproof against SQL injections is usin mysql prepared statements.
Click to expand...

From OWASP:
Although Prepared Statements helps in defending against SQL Injection, there are possibilities of SQL Injection attacks through inappropriate usage of Prepared Statements. The example below explains such a scenario where the input variables are passed directly into the Prepared Statement and thereby paving way for SQL Injection attacks.
Code: 
String strUserName = request.getParameter("Txt_UserName"); 
PreparedStatement prepStmt = con.prepareStatement("SELECT * FROM user WHERE userId = '+strUserName+'");
Click to expand...
 
Ice Cube said:
hey guys i was wondering how can i make my MySQL database safe from SQL injections and XSS exploits.
Click to expand...

Unless you've made the code, then it's quite hard. You're always at the mercy of the developer.
e.g. With Wordpress, you have to rely on the plugin developers being security conscious.

The best you can hope for is to secure your mysql install. (disable root, disable remote, etc)
 
It is hard to prevent all bad things from happening if you're not familiar with php coding at all. Check out site of your script, if it is wordpress then look for some best practices there and I am sure they have plenty of documentation
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top