I know after a very long hiatus, the last thing I probably should be wrting about is this, but this is a very serious point for me because I have recently come across sites, totally destroyed by this sort of attack. I’ve seen tables recursively dropped because of sloppy input validation on the part of the developer.

I introduce base64 to those who actually do not use it already. Now basically the idea is this: you take input from a text box and encode it as base64 before storing in the database. This changes and dangerous strings to relatively safer ones. And decode the string when you need to retrieve the information for display.

Rather a simple task in PHP with a function similar to this

function safe_insert($string){
$encoded_string = base64_encode($string);
$sql = "INSERT INTO `target_table` (`target_column`) VALUES('$encoded_string')";
if(mysql_query($sql){
return true;
}else{
return fals;
}
}

and of course to retrieve a function such as

function safe_retrieve($column, $item_id){
$sql = "SELECT `$column` FROM `target_table` WHERE `id` = $item_id";
if($result = mysql_query($sql)){
if(mysql_num_rows($result) > 0){
if($row = mysql_fetch_assoc($result)){
return base64_decode($row[$column]);
}
}
}
}

Now naturally you might want to do more with it but the main thrust of this argument is using encoding and decoding you can add an additional layer of protection to your mysql/sql database interaction.

Oh and by the way I settled for Aptana in the end. It’s solid, quicker than Netbeans (for me anyway) and tailored to exactly what I want it to do.