Tag Info

New answers tagged


For those who are looking for a key management solution for an application running in Amazon Web Services, AWS Key Management Service (KMS) may be a good option.


When talking about SQL injection, regardless of language, you should use parametrized queries. These construct a query plan ahead of time, rather than when the user provides input, so an attacker cannot easily modify how the query works. PHP supports this, but you need to use the PDO library rather than the mysqli functions. http://php.net/pdo for more ...


If you are restricted to the current statement, the exploitation is also limited to the capabilities of the current statement type. In general, a SELECT statement allows: reading data from accessible tables and databases reading files using the LOAD_FILE function writing files using the INTO … syntax executing stored procedures Of course, the way the ...


Let's remove PHP entirely from the equation for a moment. SQL injection allows an attacker to manipulate the SQL query to be what he or she wants the query to execute. This can be dumping the contents of the database, modifying data, and even code execution. The example you provided is indeed vulnerable to SQL injection. For the purposes of demonstration, ...


I suggest you define two users: 1. root@localhost with full admin rights AND complex, long password 2. work@localhost only allowed to access the tables (grant) he is supposed to with the rights (grant) adapted to normal operations (create, change row). This user should be used by all scripts around. Admin is too powerful to stay unprotected.


The first rule of 10 Immutable Laws of Security Administration written by Scott Culp, is a good law regarding your situation: Law #1: Nobody believes anything bad can happen to them, until it does. Even though your server is only accessible from within your local network, try to think of how many computers or servers are connected to that internal ...


Always Plan Ahead. It may seem like a pain to manage the passwords, and like you mentioned, they might SSH into the machine in the future. If someone can contribute the exact statistics that would be great - but most security threats come from inside your organization, not outside. Leaving no password on your MySQL server is just like leaving a printed copy ...

Top 50 recent answers are included