Airzero Sec

What Is SQL Injection?

SQL injection is specially referred to as SQLi, maybe it’s a common attack method that uses inappropriate SQL code for back-end database manipulation to access details that weren't intended to be displayed and are highly mentioned to be a secret. These details include many private and sensitive data. This sort of cybersecurity attack targets the confidential databases within the system to trick into doing unexpected and unwanted things. The best cybersecurity consulting company provides the best to protect the attackers to access the below data. It is very important to consult such companies.

Actions that successful attacks may take targets include:

• Bypass authentication
• Stealing data
• Modifying or corrupting data
• Deleting data
• Running arbitrary code
• Gaining root access to the system itself

What Is Codeigniter?

CodeIgniter is an MVC framework written in, and for, PHP. It is lightweight compared to other MVC frameworks that are used out there, at the cost of having less functionality, e.g. there will be no built-in authentication system that might be a part of other frameworks.

CodeIgniter is the best choice of frameworks for those who are starting out with MVC as it doesn't force you to use any particular standards for naming and structure of code, but it is also suitable for larger projects where a large range of features is contained in other frameworks that might not be needed in those projects.

How to avoid SQL injection in Codeigniter?

In Codeigniter, we no need to use the mysql_real_escape_string() function, Codeigniter provides inbuilt functions and libraries to generate SQL queries by using various methods or functions we can definitely avoid SQL injections. Here are the ways to prevent CodeIgniter from SQL injection. There are three methods to prevent SQL injections in the Codeigniter application, they are:

1. Escaping Queries
2. Query Binding
3. Active Record Class

Preventing SQL injection in Codeigniter by using Escaping Query Method

Example:

<?php $email= $this->input->post('email'); $query = 'SELECT * FROM subscribers_tbl WHERE user_name='.$this->db->escape($email); 
$this->db->query($query); ?>

<?php
$email= $this->input->post('email');
$query = 'SELECT * FROM subscribers_tbl WHERE user_name='.$this->db->escape($email);
$this->db->query($query);
?>

Here $this->db->escape() determines the data type so that it can escape only string data.

It also automatically adds single quotes around the data so you don’t have to think to do that as well.

Preventing SQL injection in Codeigniter by using Query Binding Method

<?php $sql = "SELECT * FROM subscribers_tbl WHERE status = ? AND email= ?"; $this->db->query($sql, array('active', ‘email’); ?>

db->query($sql, array('active', ‘email')); ?>

The question marks in the query are automatically replaced with the values in the array in the second parameter of every query function.

in the Query Binding Method, you don’t have to escape the values by yourself as it will automatically do that for you.

Preventing SQL injection in Codeigniter by using Active Record Class

Using Active Records, query syntax is generated by using each database adapter. It will also allows for safer queries, since the values are escaped automatically by the system.

<?php $this>db>get_where('subscribers_tbl',array('status' => 'active','email' => 'email')); ?>

db->get_where('subscribers_tbl',array('status' => 'active','email' => ‘email')); ?>

If you have any queries about this topic or have to get services and consultations against this serious cyber threat. Feel free to contact us. AIRZERO SEC will be your strong firewall. E-mail id: [email protected]

Author: Johnson Augustine
Ethical Hacker and Data Security Researcher
Founder: Airo Global Software Inc `
LinkedIn Profile: www.linkedin.com/in/johnsontaugustine/