I am working on how to secure login page from tautology attack. Can anybody help me on how to create blackist of SQL keywords in php ?


If you are worried about SQL injection, try whitelisting instead of blacklisting . Also parameterize input parameters and white-list only allowed chars, like [a-zA-Z0-9.] for example. SQL injection (always) relies on some delimiter like "'"--;*", or '%' in case of MS based db. I'd go with white-listing instead of thinking of every possible dangerous character there might be depending on back-end system.

  • or treat all inputs as a string
    – schroeder
    Mar 5 '15 at 18:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.