Skip to main content
143 votes
Accepted

Why can't I just let customers connect directly to my database?

TL,DR: Don't. (My-)SQL permissions are pretty fine-grained, so I'd wager there shouldn't be any obvious security issues Even with permission on the record level, it does not scale easy. If a user ...
ThoriumBR's user avatar
  • 54.5k
84 votes

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python ...
André Borie's user avatar
  • 12.8k
78 votes
Accepted

How to limit the impact of and reduce the risk of SQL injection for existing website?

Don't spend lots of time on workarounds or half fixes. Every minute you spend trying to implement anything suggested here is a minute you could have spent implementing prepared statements. That is the ...
Anders's user avatar
  • 65.6k
69 votes

Why can't I just let customers connect directly to my database?

Interesting question. In theory, this can be done securely. MS-SQL can secure the connection with encryption, authenticate the user, and provides fine-grained permissions and other security features ...
paj28's user avatar
  • 33.6k
68 votes
Accepted

CRM with Client Side Encryption

Your company should hire a security expert to help with the project, and start fresh. I know that not answering your immediate technical questions might seem frustrating, but I can promise you that no ...
Polynomial's user avatar
  • 135k
67 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

The problem of SQL injection is essentially the mixing of logic and data, where what should be data is treated as logic. Prepared statements and parameterized queries actually solve this issue at the ...
multithr3at3d's user avatar
64 votes

How to limit the impact of and reduce the risk of SQL injection for existing website?

The only correct way is to use prepared statements. If you disguise error messages, it a bit harder, but won't stop attackers. You can restrict the rights, but all rights granted to the user could ...
trietend's user avatar
  • 864
60 votes

Why can't I just let customers connect directly to my database?

I've built both RESTful interfaces and provided customers with direct SQL access. The problem here is that the question is fundamentally flawed: Lots of the work backend developers do is providing ...
NPSF3000's user avatar
  • 700
59 votes
Accepted

Why should we sometimes use --+ instead of -- in SQL injection to comment the rest of the query?

From the documentation: From a -- sequence to the end of the line. In MySQL, the -- (double-dash) comment style requires the second dash to be followed by at least one whitespace or control ...
AndrolGenhald's user avatar
48 votes

How can I secure MySQL against bruteforce attacks?

The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback ...
Ángel's user avatar
  • 18.9k
39 votes
Accepted

Second order SQL injection protection

A second order SQL injection is an injection where the payload is already stored in the database (instead of say being delivered in a GET parameter). In that sense it is somewhat similar to stored XSS ...
Anders's user avatar
  • 65.6k
39 votes

Is password information dumped from the MySQL user table sensitive?

Yes, it's sensitive information. It's a password hash leak. Attackers will supply this information to a bruteforce application (there are some tailored just for MySQL) and retrieve the password. Not ...
ThoriumBR's user avatar
  • 54.5k
37 votes

Why can't I just let customers connect directly to my database?

Performance You say that performance should be "way better", except that now you've just given malicious actors complete authority to wreck the performance of your DB. Of course, they have to ...
Lawnmower Man's user avatar
35 votes

Can I recover a lost AES key?

Realistically, no you cannot. AES is very resistant to known plaint text attacks like most block ciphers. It's lucky you didn't lose any information and have the original database backup because your ...
Aide's user avatar
  • 311
33 votes

Sql database password encryption opinion needed

No, this is not a good idea! As Lukas pointed out in an comment, you want to hash a password, never encrypt it! With your schema, it would be possible to get the plaintext passwords from an database ...
Josef's user avatar
  • 5,963
29 votes
Accepted

Understanding SQL injection payload

What does (@) and (@:=0x00) stand for in this payload? @ - is the variable name @:=0x00 - is the assignment of zero into this variable. Note: := is the assignment-operator Thanks for @Frank Cedeno ...
Yaron's user avatar
  • 522
28 votes
Accepted

Sanitizing input for parameterized queries

No, it's not necessary. But please, read on. Input sanitization is a horrible term that pretends you can wave a magic wand at data and make it "safe data". The problem is that the definition of "safe"...
marcelm's user avatar
  • 1,008
26 votes

How to limit the impact of and reduce the risk of SQL injection for existing website?

We know, but we do not have enough developers/testers to make it 100% safe. This is the real problem. Until you hire more people or reassign priorities, you're not safe. Stopping 99.9% of attackers ...
Gloweye's user avatar
  • 388
26 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

I think the main question here is why string escaping is not as good as the other methods. The answer is that some edge cases allow injections to slip through even though they are escaped. Stack ...
halfer's user avatar
  • 831
19 votes

Why can't I just let customers connect directly to my database?

This could be a reasonable approach in certain circumstances: The customer gets read-only access. They get read access to an entire database: it's either quasi-public data to all your customers, or ...
poolie's user avatar
  • 303
17 votes
Accepted

Is forbiding the ; char enough to prevent SQL injection?

TL;DR No, your friend is not right. INSERT, UPDATE, DELETE and DROP TABLE aren't the be-all and end-all of SQL risks connected to SQL injection. The very simplest thing I could do with that query is ...
LSerni's user avatar
  • 22.9k
15 votes
Accepted

How vulnerable is connecting Android App to PHP API with prewritten queries

If there's no user input used to construct the queries, there's no threat of SQL injection. This is a reasonably good way to go about allowing an Android app to get data from a shared database. The ...
Xiong Chiamiov's user avatar
15 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

While you can stay safe protecting against SQLi escaping user input, it's important to note that it may not always be enough. In this terrible example, quotes are never needed to perform a successful ...
Jefrey Sobreira Santos's user avatar
14 votes

How to extract information using a SQL injection on PHP?

There is no problem into being new to SQL injection (this one seems quite a classical example and therefore constitute a perfect start :) ), but I think it is very important to have some reliable ...
WhiteWinterWolf's user avatar
14 votes
Accepted

Are MySQL's database files encrypted?

Are MySQL database files that are stored on disk encrypted? No, they are not. You can (relatively) easily test this by moving .ibd or .myd files to a different system, where you can still read them....
tim's user avatar
  • 29.7k
14 votes

Why can't I just let customers connect directly to my database?

Here’s a Bayesian kind of answer... We collectively, as an industry, have about three decades experience designing 3-tier user-facing applications and have amassed a great body of knowledge on how ...
jl6's user avatar
  • 635
11 votes
Accepted

Hack my server, please?

You're looking for a penetration tester. You could also invite people on the net to try and hack your server, but that's a very risky business - you never know who's going after it. Telling the ...
S.L. Barth is on codidact.com's user avatar
11 votes

Can I recover a lost AES key?

What you are asking for is a known-plain-text attack (KPA). The weakness you describe in ECB is where two encrypted blocks with the same plaintext are encrypted with the same ciphertext. This just ...
Lucas Kauffman's user avatar
11 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Because you're doing the same amount of work for better security A common trope mentioned against PHP is mysqli_real_escape_string() (look at how long it is! Can't they be consistent with nomenclature?...
Machavity's user avatar
  • 3,798
10 votes
Accepted

Best way to know the algorithm used for a password encryption

How are passwords stored? Passwords are not (or at least should not be) stored using encryption. They should be stored using a hashing algorithm. So if you are trying to decrypt it to recover the ...
Mike Ounsworth's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible