So, what is SQL injection, anyway?

Say you have a register on your site. You have people type in their username and password. Of course, you're going to insert that data into a database... right?

Unless you're careful, people can hack your site like this.

Assuming you're storing the data in variables (i.e. $username = $_POST['username'] ), and then putting those variables into a string you'll user as a SQL query (i.e. $q = "INSERT INTO table VALUES (" . $username . ", " . $password . "", then you're vulnerable to SQL injection.

What happens if they type in bob"; TRUNCATE table?

Well, that's what SQL Injection is.

This isn't the only way to SQL Inject, so be careful.

If you read the introduction, then you already have an idea how to do it.

There are a few ways to do this, but the simplest way would be to type something into a login.

You type something like this in:
thisismyusername"; DROP something;

Hit enter/submit, and you're done.
(if it worked)

How does it work?

Well, think about it for a second.
When you're logging in, this is the gist of what's going on in the code:



Emphasis on the mysqli_query.

Now, since they're putting a variable that you control into an SQL command, you can mess sht up.

Once you type something like tom"; TRUNCATE something into the thingymabob that's going to be put into an SQL command, you can pretty much do whatever you want with SQL.

Why?

Because then the SQL command would look like this:


Now, obviously, that code has a few bugs in it, but you can sort those out.

How do you protect against it?
Very simple, if you're using MySQLi, like you should be.

Before you insert those variables into a database, do something like this...



That's the simplest way, if not the only way; If you're that concerned about it, do a Google search about advanced protection methods or sumthin.