dougandrews.co.uk

If you have a website which is powered by a database it is potentially vulnerable to SQL injection attacks – this is relatively simple to protect against and the risks of not doing so are to compromise the integrity of the data stored on your server and possibly the website itself.

What is an SQL Injection attack?

Most websites will pass data from one page to another in order to maintain continuity. For example you might be looking at a list of products and you click on a particular product for more information. The website will pass the ID of the product in question to the next page so that it know what informationt o serve to the customer.

In many cases this is passed in the URL, so you might have  something like www.examplewebsite.com/propduct?id=xyz

An SQL Injection attack occurs when the recipient page takes the XYZ in the URL and makes a query with the database without verifying first that it doesn’t contain any additional and unexpected nasties.

How do I stop Injection attacks?

The key is that every time you retrieve a variable which you intend on passing to the database, check that it is in the expected format. Usually a product ID would be numeric, and not include any other characters. A date might be in the dd/mm/yyyy format. Once you have predetermined what format you expect each variable to be in, create a rule to check it prior to submitting it to the database – and if it fails stop the process.

I know what format I expect it to be in, but how do I check it?

The PHP code preg_match is probably the best method as it allows you very specific controls.

The following would check the variable $input for a date in the format yyyy-mm-dd. If there are any other characters, the page would be redirected to a page where no database queries are made, so stopping the threat.

if (!preg_match(‘/^[\-+]?[0-9]*\-?[0-9]*\-?[0-9]+$/’, $input)) {
header(“Location: http://www.examplewebsite.com/404redirect.php);
exit;
}

The following test just allows numeric characters, any number of them, but anything else kicks it out:

if (!preg_match(‘/^[\-+]?[0-9]+$/’, $input))

You can also allow alphabetical characters, in the following case any character in either upper or lower case:

if (!preg_match(‘/^[\-+]?[a-zA-Z]*+$/’, $input))

There are plenty of guides on the Internet about how to use preg-match()

Simplify the process

You will probably find that you use one or two formats a lot, so create a function where you pass the variable and the type of format expected, then each time you retrieve a variable run it through your function to verify it is of the expected format.

Setting up an autoresponder for your emails for when you are away is relatively well documented but there are some additional things you need to do to ensure it works as you plan, otherwise you can get caught out.

1. The autoresponder loop

If you setup an autoresponder to simply reply to any incoming email with a ‘I’m away email’ then you can get caught in a loop if the sender has setup a similar autoresponder. i.e. I received an email from ebay, to which my autoresponder replied to say I was away, to which ebay replied that ‘my message was important to them’ or somesuch, to which my autoresponder replied to say I was away to which … you get the idea. I had set up various filters etc to keep my emails to the minimum so I could pick them up remotely on my iphone, where I was paying according to the volume downloaded. This loop generated an email about every other minute until I was ironically rescued from drowning in auto emails by:

2. The automatic update

If you forget to switch it off, Windows will automatically check for updates and install them, if that means a restart then your emails are no longer checked and the autoresponder doesn’t kick in.

These two both caught me out but a third which I DID manage to do but which I don’t see often mentioned is to ensure that your computer is set not to sleep after a certain amount of time.

Solutions:
1. It is unfortunately difficult to make this 100% foolproof as not all autoresponders reply with a copy of your original email, so you can’t simply check for a word used in your original email to stop the process. My best effort would be to create a rule which sits above your autoresponder, which checks for :
- a word (such as ‘autoresponder’ or whatever you have used in your reply)
- certain give-away addresses, such as ‘donotreply@’, ‘blackhole@’ etc
- any domains which you happen to know of which has this kind of receipt notification set up

If any of the above are found stop the system from processing any more rules, so it never reaches your autorresponse rule.

2. stop the computer from updating

Go to : control panel > system and security > windows update > change settings.

Change important updates to: anything except install automatically.

Note that this does pose a minor security risk but you can’t have your cake and eat it, just remember to turn it back on when you return.

3. stop the computer from sleeping

Go to : control panel > hardware and sound > power options > edit plan settings.

Change put the computer to sleep: never

These settings in 2 and 3 are for Windows 7.