Let's briefly talk about sequel injection defenses.
Now there are more than two defenses out here but these are the two big ones and really the biggest
one is parameter statements or parameter I's queries.
And what that means is it ensures the inputs or also known as parameters are used safely in sequel statement
so they're passed through the sequel statement safely.
An example here I have are a good example and a bad example so here's a good example.
We've got select WILD CARD FROM users where email equals question mark OK.
And what does that mean.
Well the way we're passing data here is the parameter string is going to be passed separately then the
parameter is being provided.
OK.
In this statement here where we say select WILD CARD FROM users where email equals and then we just
provide the e mail as like a variable it's going to take the entire sequel statement and it's going
to provide it all at once.
So this parameter I statements is is really the way to go and this is just responsible coding.
OK.
And this is when I said in the first video that sequel statements or sequel injection tax are easy to
prevent.
They are.
I mean look at the difference in the code here but you still get coding that comes out like this and
allows for equal injection attacks.
The other idea behind this is to sanitize input.
Remember when we had the single quote and we had the one equals one type statement and that should never
happen right.
So if we have that kind of statement that should be sanitized and you could sanitize all the way down
to very specifics like you should not have the like a single quote in there or you can specify entire
statements like the single quote or one equals one dash dash for example you could take that entire
statement say hey that's suspicious I'm going to sanitize that.
So ensuring that the input that is provided is not malicious is important as well but we can prevent
it here entirely with premature statements by ensuring that the parameters are sent separately.
Right.
So that's really the big takeaway here.
If you're asked on an interview how you can do this parameter statements should be your first answer.
You can also talk about sanitizing input that would go over well as well but we're after no one here
or we're interviewing.
So that's it for here.
We're going to go ahead move on to the next attack and I will see you over in the next video.