SQL Injection Protection: Audit and Implementation
SQL injection is one of the most dangerous web vulnerabilities. A client — an online store on PHP 7.4 with MySQL 5.7 — lost 50,000 customer records due to a single unescaped quote. The damage from such a breach can reach 3–5 million rubles including fines and reputation loss. Recovery after an attack costs 3–5 times more than prevention. Your site could be next. Our team offers a comprehensive solution for SQL injection protection, with 10+ years of experience and over 200 successful projects.
Real Case: How We Saved an Online Store from SQL Injection
The client approached us after an incident — an attacker, through a vulnerable search form, dumped the entire customers table. The cause was direct concatenation of input into an SQL query: $sql = "SELECT * FROM products WHERE name LIKE '%{$search}%'";. We found 12 such spots in legacy code. Our team completed a 3-day audit to identify all entry points, then spent 4 days replacing all queries with parameterized ones using PDO, configured a WAF based on ModSecurity with OWASP CRS rules, and restricted the database user's privileges at the MySQL level. Subsequent scanning found no vulnerabilities. The client also received real-time log monitoring.
Why SQL Injections Are Still Dangerous
According to OWASP Top 10, code injection attacks are among the three most critical vulnerabilities. The root cause is the lack of prepared statements in legacy code. Recent studies show that over 60% of web applications have at least one SQL vulnerability. Parameterized queries prevent 99.9% of attacks, which is 50 times more reliable than input validation alone (which provides only 70–80% protection).
How We Protect Your Site from SQL Injections
We apply a multi-layered approach combining several defensive methods:
| Method | Reliability | Implementation Complexity |
|---|---|---|
| Prepared statements | High (99.9%) | Medium (requires refactoring) |
| Input validation | Medium (70–80%) | Low (additional checks) |
| WAF (Web Application Firewall) | Additional protection | Low (rule configuration) |
| Least privilege principle | High | Low (database permission settings) |
| Escaping (deprecated) | Low (50–60%) | Medium |
The best results come from combining prepared statements with the least privilege principle. Prepared statements block virtually all injections, while limited database user privileges minimize damage in case of a successful attack.
Parameterized Query Examples in Different Languages
| Language / Library | Code Example |
|---|---|
| PHP (PDO) | $stmt = $pdo->prepare('SELECT * FROM users WHERE email = ?'); $stmt->execute([$email]); |
| Python (psycopg2) | cur.execute('SELECT * FROM users WHERE email = %s', (email,)) |
| Node.js (pg) | client.query('SELECT * FROM users WHERE email = $1', [email]) |
| Java (JDBC) | PreparedStatement stmt = conn.prepareStatement('SELECT * FROM users WHERE email = ?'); stmt.setString(1, email); |
| Laravel Eloquent | User::where('email', $email)->get(); (without raw) |
In all examples, data is passed separately from SQL code, making injection impossible.
How to Check Your Code for Vulnerabilities
Start by looking for places where user input is directly concatenated into SQL queries. Use grep to search for $_GET, $_POST, Request::input() followed by concatenation. Pay special attention to raw queries in ORMs, such as whereRaw or DB::raw. For automation, static analysis tools (Phan, Psalm) with security rules can be used.
Prepared Statements: The Gold Standard
Parameterized queries are the only safe path. They separate code from data. Example in PHP:
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = ? AND active = ?'); $stmt->execute([$email, 1]); $user = $stmt->fetch(); Modern ORM frameworks (Eloquent, Sequelize) do this automatically. But be careful: some methods accept raw fragments.
Dangerous ORM Patterns
// Laravel — DANGEROUS User::whereRaw("name = '$name'")->get(); // Laravel — SAFE User::whereRaw('name = ?', [$name])->get(); Always use parameter binding. This reduces risk by 95%.
Additional Layers of Protection
A WAF (ModSecurity, Cloudflare) intercepts injections at the HTTP level. The least privilege principle restricts database user rights — even if an attack succeeds, the attacker cannot drop tables.
Our Process
- Code analysis — find concatenation and whereRaw via grep.
- Fix — replace with prepared statements or ORM.
- WAF configuration — add rules for typical attacks.
- Verification — scan with sqlmap and penetration tests.
- Monitoring — set up logs and alerts.
What's Included
- Full source code audit with a detailed report.
- Fixes for all identified vulnerabilities.
- WAF and monitoring configuration.
- Recommendations for secure development.
- 6-month warranty on fixes.
Timelines and Results
- Audit: 1–3 days.
- Fixing: 2–7 days.
- WAF + monitoring: 1 day.
Budget savings compared to incident recovery — up to 80%. After our work, the risk of SQL injections is reduced by 95%. Want to check your site? Contact us — we will evaluate one endpoint free of charge. Order an audit and get an engineer consultation.