From the course: Programming Foundations: Secure Coding

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Database issues

Database issues

From the course: Programming Foundations: Secure Coding

Start my 1-month free trial

Database issues

“

- We talked about a couple of the potential issues with databases from other perspectives, but databases and other backing services are used in multiple ways in targeted attacks. Let's start our discussion once again with SQL injection attacks. I mentioned these attacks when we discussed user input validation and indeed that is a good mitigation for these attacks. Another good mitigation is the frameworks and strategies that we use to connect to databases. SQL statements should include bind variables and parameters. Now, you can write full statements or use bind variables. Creating full statements is susceptible to injection attacks because those statements are often concatenated with user input strings like in our previous example. But, when you use bind variables and parameters, you remove that risk because of how the drivers will create the statement for you and escape the dangerous behavior. Using a bind variable…

Contents