[BarNunBoi]

I just have a quick question...what is the best way to defend against or prevent SQL Injections??

[jon.kiparsky]

Take your SQL in pill form.

/rimshot

[macosxnerd101]

You can use Prepared Statements.

[e_i_pi]

Lol, +1

Here's some tutorials on DIC by Dormilich that sugar-coat the experience for you. As much as Dormilich sugar-coats things anyhow:
Introduction to PDO
Be prepared for your database

[evaaggy]

If you are using asp.net then look at this tutorial. It gives the best practice to prevent sql injection
SqlClient

[jammmie999]

...by vigorously validating your database inputs.

[BobRodes]

The best single specific is to use stored procedures, and accept user input as parameters, rather than plugging user input into strings of sql instructions and passing them to your database. And then "vigorously validate your database inputs" from there.

[BarNunBoi]

What is the best way to prevent SQL Injections for CakePHP's upload button. Please post some links to some reference material. Thanks!

This post has been edited by BarNunBoi: 06 November 2012 - 03:01 PM

[JackOfAllTrades]

CakePHP's "upload button"? What is that? Link please.

[BarNunBoi]

Excuse me.....how do prevent injections from the form? I have a form that's allows users to upload data from a spreadsheet and I don't want to be vulnerable to attacks.

[laytonsdad]

http://api.cakephp.org/class/mysql

I believe cake PHP uses PDO

I may be wrong but that is what I have read.