Guys, i'm strugling myself about security issues.
I have to connect to my ISP Database, there is no other way around it...i cannot put a Webapp in there and cannot use RDC, ADO or whatever. I need PHP + Mysql Connection.
What Worries me is Possible SQL Injection...2 things.
1 - That someone use a Select Outside from my app (my app will have Login system)
2 - That someone inject a Drop or Delete, or something that can mess the DB.
Solutions on 1. I create a Session Control making a Unique ID in the $_SESSION that copies to the appp when a login User&password success, saving this IS in a App Variable.
Someone consider a better aproach on this?
Solution on 2.. simple IF App(idSession) = $_SESSION then Execute...
Again...Do you think is a good aproach?
Another way that i consider is that The Application Send the fields and the table only (not the Query) and then in then PHP i concatenate String a make the correct SELECT XXXXX... like in the PHP is the SELECT XXXXX FROM XXXX format and receive fields and Table from the php://input to complete the query. So if someone try to inject something else it will no return anything because of a format error.... Is this crazy or what?
Thank you
I have to connect to my ISP Database, there is no other way around it...i cannot put a Webapp in there and cannot use RDC, ADO or whatever. I need PHP + Mysql Connection.
What Worries me is Possible SQL Injection...2 things.
1 - That someone use a Select Outside from my app (my app will have Login system)
2 - That someone inject a Drop or Delete, or something that can mess the DB.
Solutions on 1. I create a Session Control making a Unique ID in the $_SESSION that copies to the appp when a login User&password success, saving this IS in a App Variable.
Someone consider a better aproach on this?
Solution on 2.. simple IF App(idSession) = $_SESSION then Execute...
Again...Do you think is a good aproach?
Another way that i consider is that The Application Send the fields and the table only (not the Query) and then in then PHP i concatenate String a make the correct SELECT XXXXX... like in the PHP is the SELECT XXXXX FROM XXXX format and receive fields and Table from the php://input to complete the query. So if someone try to inject something else it will no return anything because of a format error.... Is this crazy or what?
Thank you