gowthamdeena's avatar

How to prevent Laravel SQL injuction

Hi,

Anyone suggest how to prevent SQL injection

0 likes
9 replies
Snapey's avatar

Using Eloquent is a good start. If you avoid raw statements with query builder then you will be protected.

gowthamdeena's avatar

Someone hit URL like below one

mydomain.com/index.php/informations?id=311%2527+AND+%25271%2527%253D%25271%2527+--+

here they to SQL inject query %2527+AND+%25271%2527%253D%25271%2527+--+ is present.

incase this type of commend is appear it redirect to 403 error kindly suggest me

Snapey's avatar

When someone tries that URL what do you want the response to be?

jlrdw's avatar

You can type anything in the URL, but that doesn't mean it will actually be used anywhere if you take the right steps.

If ever dealing with a raw SQL statement you can still bind your parameters.

Likewise if someone changes the ID, your query should check if the authorized user ID is correct.

gowthamdeena's avatar

in example my website correct URL is example.com/pages.php?id=2

But someone tries to example.com/pages.php?id=2' or '1'='1'

It automatically redirects to 404 or 403 error

henriquesalvan's avatar

You can do validation on controller

    public function page(Request $request)
    {
        $validator = Validator::make($request->all(), [
            'id' => 'required|integer'
        ]);

        if ($validator->fails()) {
            return redirect('where you whant');
        }

        // continue...
    }

Validation: https://laravel.com/docs/7.x/validation

Snapey's avatar

It automatically redirects to 404 or 403 error

So SQL Injection was prevented.

Can I please suggest you find out what sql injection actually means?

Please or to participate in this conversation.