- Let's go over different SQL injection prevention
recommendations, and specifically the ones by
industry leaders within the OWASP organization, right?
The number one recommendation here is the use
of prepared statements with parameterized queries.
That by far is one of the most effective ways to combat,
and to prevent, SQL injection vulnerabilities.
As you know, SQL injections basically are
introduced whenever software developers create
dynamic database queries that include users-applied input
and you do not sanitize input successfully, right?
So input validation is absolutely crucial here, right?
So option two is the use of stored procedures.
And that is also an alternative way of preventing
SQL injection. We talked about input validation,
allow-list or in the case of input validation,
kind of the opposite instead of doing block list,
in this case is actually, y'know, performing allow-list
of input that is deemed to be appropriate
to be evaluated by a web application.
And then lastly, escaping all user supplied input.
Now there are some additional defenses that you can employ
and those include enforcing least privilege
which is the best practice that you should do anyways.
So the least privilege concept of only providing the
privilege that the application, or user, in this case
we're talking about applications that they need in order
for them to actually perform whatever operation
that it's designed for, right? And not more.
So, in other words, don't run your applications as a route.
Now, the second one is performing allow-list
for input validation as a secondary defense.
Even though we have it above, in here, basically using it
as a secondary defense, let's say, if you use
parameterized queries.
Now I want to draw your attention to this prevention
cheat sheet that is also a created project
by the OWASP organization.
So if you click on that, it will take you to this page
and, you already know that the OWASP, or the open web
application security project initiative and foundation,
they have this project called the Cheat Sheet Series.
And you see that there are a significant amount
of proactive controls and prevention techniques
for many different vulnerabilities.
They have one specifically for SQL injection
or sequel injection, and they explain all the different
defenses that I just went over,
and they provide examples of those defenses as well, right?
Remember that we were talking about different
Boolean statements, and how an attacker can use them
to manipulate in the web application and a database,
to potentially reveal sensitive information from a
database while a parameterized query will not be vulnerable
to some of these, if you implement them correctly.
So again, take advantage of this resource.
It goes beyond the scope of the CEH exam,
but it's something that I strongly recommend
for you to become familiar with.
Not only about the attacks, y'know, and become familiar with
what vulnerabilities all about how to exploit
those vulnerabilities, but what are the recommendations
on how to prevent them, or mitigate them, or, y'know
of course eliminating them from your applications.