I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database if I have enabled both
closed as not a real question by Polynomial, Gilles, AJ Henderson, Lucas Kauffman, Scott Pack Jan 5 at 15:56
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
In addition to what others have said, your question demonstrates a category mistake. You're talking about "securing your site" and you listed two countermeasures.
CAPTCHA is meant to deter automated submissions - to prevent automated programs from submitting data to your application. This doesn't prevent a human being from inserting malicious/garbage data.
Neither of these have anything to do with bad data getting into your database (except incidentally). The only way to prevent bad data from getting into the database is to filter input, which is done via a combination of input form validation, and proper SQL Injection prevention techniques (not contencating strings, using parameterized stored procedures or prepared statements if the language supports them, etc.
In your case, the most relevant is input validation. And I strongly recommend a white-list approach if feasible.
No offense, but your question indicates that your level of familiarity with basic secure web development principles is on the beginner end of the scale. (And I really mean no offense! It took years for me to understand as much as I do now, and I'm STILL not an expert!)
Actually securing your site (at least making it as secure as humanly possible requires an understanding of all the threats and potential attack surfaces of your website, as well as an understanding of the strengths and weaknesses of your platform and even programming language.
I'd strongly recommend spending some time at the OWASP site, starting out in the OWASP Top 10. This is an excellent research for learning about the various threats out there, and how to best protect yourself against them. Even if you don't find specific code samples for your language/platform of choice, you'll gain enough knowledge to perform more intelligent Google searches, and better find specific advice applicable to your chosen tool-set.
Learning secure web development principles simply isn't optional, it's a must.
You're probably falling victim to SQL injection, which neither CSRF tokens or a CAPTCHA will prevent. If you're using
|show 4 more comments|
Try to find out how is the junk data inserted. First check which tables and which fields in the database are affected. After you make a list with these fields, check your code and see where they are referenced. This may help you detect the vulnerable code, by analyzing the respective functions.
If the problem you have is on inputs that are publicly available (contact forms) for non-authenticated users and the only way to prevent automated attacks is through CAPTCHAs, take into account that the CAPTCHA implementation may be faulty. I've seen numerous websites where the same question is displayed every time (e.g. 2+3=?).
There are many ways in which a CAPTCHA library can fail. What CAPTCHA library are you using?