I am working on how to secure login page from tautology attack. Can anybody help me on how to create blackist of SQL keywords in php ?
If you are worried about SQL injection, try whitelisting instead of blacklisting . Also parameterize input parameters and white-list only allowed chars, like [a-zA-Z0-9.] for example. SQL injection (always) relies on some delimiter like "'"--;*", or '%' in case of MS based db. I'd go with white-listing instead of thinking of every possible dangerous character there might be depending on back-end system.