Using Eloquent is a good start. If you avoid raw statements with query builder then you will be protected.
How to prevent Laravel SQL injuction
Hi,
Anyone suggest how to prevent SQL injection
Someone hit URL like below one
mydomain.com/index.php/informations?id=311%2527+AND+%25271%2527%253D%25271%2527+--+
here they to SQL inject query %2527+AND+%25271%2527%253D%25271%2527+--+ is present.
incase this type of commend is appear it redirect to 403 error kindly suggest me
When someone tries that URL what do you want the response to be?
You can type anything in the URL, but that doesn't mean it will actually be used anywhere if you take the right steps.
If ever dealing with a raw SQL statement you can still bind your parameters.
Likewise if someone changes the ID, your query should check if the authorized user ID is correct.
It automatically redirects to 404 or 403 error
in example my website correct URL is example.com/pages.php?id=2
But someone tries to example.com/pages.php?id=2' or '1'='1'
It automatically redirects to 404 or 403 error
You can do validation on controller
public function page(Request $request)
{
$validator = Validator::make($request->all(), [
'id' => 'required|integer'
]);
if ($validator->fails()) {
return redirect('where you whant');
}
// continue...
}
Validation: https://laravel.com/docs/7.x/validation
It automatically redirects to 404 or 403 error
So SQL Injection was prevented.
Can I please suggest you find out what sql injection actually means?
sure
Please or to participate in this conversation.