0

I know that SQL Injection can be sanitized by using

mysql_real_escape_string();

but how to Sanitize Blind SQL Injection and how is it different from normal sql injection.

1
  • Blind SQL injection is sanitized the exact same way as SQL injection... the only different thing about Blind SQL injection is that SQL syntax errors are not shown; a generic message is shown instead.
    – CoderPE
    Nov 17, 2018 at 21:58

2 Answers 2

2

Blind SQL injection and "normal" SQL injection are both SQL injections, i.e. the attacker is able to modify the SQL statement sent to the database. The only difference is that with blind SQL injection the attacker does not see any obvious result (i.e. data returned by the database) but can only deduct from timing, error messages or similar what happened in the database. See OWASP for more information.

Because the cause of both blind SQL injection and "normal" SQL injection is the same the prevention is too, i.e. make sure that the attacker cannot modify the SQL in a malicious way. The preferred way to do this is parameter binding and not escaping (i.e. mysql_real_escape_string). For more information how to do it right see Bobby Tables: A guide to preventing SQL injection which both describes the problems and has also solutions in various languages like for PHP.

1

Using parametrized queries! http://php.net/manual/en/mysqli.quickstart.prepared-statements.php http://php.net/manual/en/pdo.prepared-statements.php

That way you also don't - always - have to worry about escaping everything always each time, in each query.

Also I'd like to mention that mysql_real_escape_string(); is outdated.

mysqli_real_escape_string();

Is the current supported version.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .