We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or 2 guys to patch them all. So we decided to fix as many vulnerabilities as possible (prepared statement) but at the same time accept the fact that it is impossible to reach 100% sql-injection proof.
We have list many things we could "easily" do to reduce the risk/damage from SQLi hackers. One of them is split admin module to and internal server which is not open to the internet, this did help a lot when the hacker(s) managed to crack admin password but could not do much harm to the system.
Now we want even more: Hiding admin id from the database, admin along with moderators id are currently stored in some "Moderators" table. So we think it is easier to us to move admin ID to some (config) file , because we rarely add/remove admin. Moderators id is still store in that table though. Now hackers need to guess which user among half a million record of "user" table.
My question : with admin module not available to the internet, is the hosting server ( Ubuntu ) safe from being taken over by hackers? In the mean time, we tolerate the attacks to normal/moderator user and the intrusion to the DB.
- The website owner is gathering more $$ for ultimate SQLi fix.
- It seems even prepared statement are not 100% safe: Are prepared statements 100% safe against SQL injection?
- Even a baby know hard-coding is a big "no no" but that the best we can think of ....