SQL Injection Protection

I am wanting to buy sql injection protection for my server add me
skype live:vexmega

You dont need to buy stuff like that.
SQL injection is a kind of website attack, if you have a website like the cms you are safe.

Quote:

Originally Posted by EEOI You dont need to buy stuff like that. SQL injection is a kind of website attack, if you have a website like the cms you are safe.

Toxic's cms doesnt have sql injection o.O

Make sure MySQL is listening on localhost which prevents outside connections. From there as long as your website is secure with a sanitization function to ensure input is clean w/ preferably the use of PDO, then you're safe.

Quote:

Originally Posted by PizzaGuy Make sure MySQL is listening on localhost which prevents outside connections. From there as long as your website is secure with a sanitization function to ensure input is clean w/ preferably the use of PDO, then you're safe.

Nope, its no problem to use a user with remote connection, you can insert, delete, update with a local user like a remote user... better way is to set permissions for users 4 tables.

Use mysqli to connect, pdo is simple too but with mysqli you can replace the mysql connect with this function 1:1.
Do a whitelist for inputs.

PDO > mysqli

Quote:

Originally Posted by Ih¢sãs123 Nope, its no problem to use a user with remote connection, you can insert, delete, update with a local user like a remote user... better way is to set permissions for users 4 tables. Use mysqli to connect, pdo is simple too but with mysqli you can replace the mysql connect with this function 1:1. Do a whitelist for inputs.

The MySQL server doesn't establish a remotely connectable socket when it's bound to localhost. When that is done there is no communicating with MySQL other than locally. You cannot remote into MySQL and control it remotely when it's bound to localhost. So unless you have root access to the server or have abused the web server or web script, you'll never gain access to the database server. Which can be tough for management but it's bulletproof secure. I would also stick to PDO and binding.

Quote:

Originally Posted by wizatek PDO > mysqli

Named parameter, but mysqli is a little bit faster qqq.

I like speed, so PDO < mysqli for me.