[Re]Encoded.com

Top Security Tips for Working with MySQL

Having your website connect to a database is pretty much like opening up the backend of your website and letting users manipulate the data. What this means is, whether you secure the connection and data being inputted or not, data is still being manipulated.

Many new developers tend to not secure and sanitize the data being inputted into their database, which opens up many security vulnerabilities to your database and its data. We cover five vital tips to keeping your database secure from user inputted data.

Front End Security

One of the major things you need to do in terms of front end, before the data is being stored into your database, is to perform some sanitization checks on the user input. For example, let us say you need the age and username of new registrants, the age is an integer, and the username is alphanumerical.

So instead of taking this data and sending it directly to your database, verify that the age is indeed an integer as well as the username is alphanumerical. This is basic step toward better security and it does prevent many security flaws.

Table Structure Data Types

Data types for fields are another major aspect that is sometimes missed. If only integers are being stored into a field, make that field’s data type an integer, of course depending on its length (int, bigint, etc). By doing this, it prevents any data that may cause damage to be filtered out, as all that can be inputted are integers as well as it increases performance.

Data Sanitizing

Despite front end and table structure security measures, the data being inputted to the database should be completely sanitized. If string data is being inputted, assure it is sanitized by escaping quotes, special characters, and the likes. Remember, if the data is not being sanitized on input, it can play with your query causing damage to your tables, data, and database.

Update MySQL Versions

One thing we usually tend to get lazy upon is staying up to date with the latest versions and patches. However, not doing so can cause negative and undesired affects if security holes have been breached. Now I am not saying to update to new feature releases frequently if undesired, but rather to security patches and releases as they do bring you one step forward to keeping secure.

Never Store User Inputted Data Directly

This has to be one of the most common mistakes made by many new developers in the industry. Instead of sanitizing or even checking the data by the least, they directly tie the grabbed data into a query and send it directly to the database or run the user provided data by a delete query or similar.

This is a security breach waiting to happen as your query can be indirectly or directly controlled right from the users’ fingertips. Instead, make sure you sanitize the information and perform multiple checks to assure it was what you want to be collecting and storing before you run it through a query.

Overall, there is a plethora of techniques to sanitize user input and to help secure your database from being vulnerable depending on the type of information that is being manipulated with. One of the best practices to use is to build a test environment and attempt to throw unintended data at your input fields to assure that you have covered all corners in terms of security whether be it SQL injections or others.

Another great method to help secure your database and user inputted data is to try out some programs that perform several tests on your input fields that can provide a general idea of where you are at.

Web Security Isn’t Scary!

Security is the lifeblood of any web application and every online business. No matter how hard you work designing a great site, creating high-end content, building a lively traffic stream, and improving every aspect of your online business, it can easily be stolen away if you aren’t protected.

Protecting your web presence seems like a daunting task, but there are simple solutions that any webmaster can do to increase security of their applications. More »

3 Handy Computer and Internet Security Tips and Tutorials

Most of us never consider that a customs official could confiscate our laptops as we travel across borders, copy information from it and return it to us hours (or days or weeks) later – but it happens. C|net has created a handy guide for frequent travelers who are concerned about this issue and wish to protect their personal or professional data from prying eyes.

OK, so we’ve all probably considered what it would be like to be one of those poor saps who falls victim to online con artists – but how many of us have thought about what it would be like to think like one of these con artists? This ‘guide’ takes you on a brief and somewhat disturbing tour of how to approach cons and respond as a con artist would on the internet. Strange but interesting.

In most cases people would like to think they would at least know if they had been hacked even if they were unable to prevent it in the first place. However, many people remain completely oblivious to the fact that things as private and important as their email have become compromised. MakeUseOf has created a guide to making digital ‘tripwires’ so you’ll know if you have been hacked.