SQL injection is a code injection technique that attackers use to exploit vulnerabilities in a web application’s database layer. This can lead to unauthorized access, data theft, data loss, and even loss of control over the server.
SQL injection vulnerabilities are among the most common and most harmful security flaws in web applications. These vulnerabilities can lead to severe consequences, including data breaches and unauthorized access to sensitive data.
Do not concatenate strings to form SQL queries; instead, use parameterized queries or prepared statements. Concatenating strings can lead to SQL injection if the inputs are not properly sanitized.
Non-Compliant Code Examples
<?phpclassUserControllerextendsController{publicfunctionshow($userId){$query='SELECT * FROM users WHERE id = '.$userId;$result=dbx_query($connection,$query);returnview('user.show',['users'=>$result]);}publicfunctiondisplay($userId){$connection=db2_connect($dbName,$dbUser,$dbPass);$sql='SELECT * FROM users WHERE id = '.$userId;$result=db2_exec($connection,$sql);returnview('user.show',['users'=>$result]);}publicfunctionfindByEmail($email){$query='SELECT * FROM users WHERE email = '.$email;$result=mysql_unbuffered_query($query,$connection);returnview('user.show',['users'=>$result]);}}
Compliant Code Examples
<?phpclassUserControllerextendsController{publicfunctionshow($userId){$result=DB::table('users')->where('id',$userId)->get();returnview('user.show',['users'=>$result]);}publicfunctiondisplay($userId){$connection=db2_connect($dbName,$dbUser,$dbPass);$sql='SELECT * FROM users WHERE id = ?';$stmt=db2_prepare($connection,$sql);db2_bind_param($stmt,1,"userId",DB2_PARAM_IN);db2_execute($stmt);$result=db2_fetch_assoc($stmt);returnview('user.show',['users'=>$result]);}publicfunctionfindByEmail($email){$result=DB::table('users')->where('email',$email)->get();returnview('user.show',['users'=>$result]);}}
シームレスな統合。 Datadog Code Security をお試しください
Datadog Code Security
このルールを試し、Datadog Code Security でコードを解析する
このルールの使用方法
1
2
rulesets:- php-security # Rules to enforce PHP security.