|No such thing as a small change|
Securing DB transactions with user form inputby punch_card_don (Curate)
|on Feb 03, 2008 at 19:22 UTC||Need Help??|
punch_card_don has asked for the
wisdom of the Perl Monks concerning the following question:
In researching the title question for DBI applications, I came across this page: SQL Injection Attacks by Example.
Scroll down to Mitigation : Use bound parameters (the PREPARE statement) , where the example in Perl uses placeholders in a prepare statment, like this:
...at no point do the contents of this variable have anything to do with SQL statement parsing. Quotes, semicolons, backslashes, SQL comment notation - none of this has any impact, because it's "just data". There simply is nothing to subvert, so the application is be largely immune to SQL injection attacks.
...enormous security benefits. This is probably the single most important step one can take to secure a web application.
If so, I'm thinking this should just be standard practice for any and all DB transactions that pass user input to an sql statement.
So the question to this post is whether the Monastery agrees with the assertions of ths website.
Forget that fear of gravity,
Get a little savagery in your life.