A.R.M. Yourself Against SQL Injection

Tuesday, August 08, 2006

To effectively protect your web application from SQL injection attack, you must ARM yourself. That is, when writing applications, be sure to validate all input strings. There are three, and only three, options when given a piece of data:

• Accept it
• Reject it
• Modify it

It might seem obvious that all input must be validated. Too often, webmasters and programmers are focused on getting a working application under time pressure and may not implement the best security practices.

So what does it mean to ARM yourself? Well, one good step is to use the string cleansing functions of your programming language. Also, if a field is supposed to be a number then explictly convert it from a string to number.

I originally talked about this at the ACMSE-2006 conference in May. I will have to write up some more on the topic at a later date.