You can protect a database by blocking SQL parameters that match certain patterns commonly used
in malicious queries.
This security feature checks for and prevents potentially harmful inputs in the following
categories:
Logical Condition Checks
The queries that contain suspicious logical expressions, such as always-true
or always-false conditions, or direct comparisons using AND and OR
operators, which attackers often exploit in injection attacks.
Data Manipulation Commands
The common SQL statements that read or modify data. This includes the
following commands:
SELECT
INSERT INTO
UPDATE
DELETE
UPSERT
Transaction and Procedure Controls
The statements that handle transactions or call stored procedures, such
as:
SAVEPOINT
CALL
ROLLBACK
KILL (used to terminate processes)
Schema and Database Structure Changes
The commands that create, alter, or delete database objects or locks.
This includes the following commands:
CREATE (tables, indexes, and so on)
ALTER (tables, indexes, and so on)
DROP
TRUNCATE
LOCK and UNLOCK and lock release commands
Metadata Inspection
The queries that retrieve schema information, such as:
DESCRIBE
DESC
Suspicious Comments and Statement Delimiters
The queries that contain SQL comments (/* ... */, -- ...) or statement
delimiters (;) commonly used in injection attempts.
Although this protection significantly
reduces the risk of SQL injection, it might not apply to all conditions. You might want
to apply additional security best practices and validate inputs within your application
to ensure complete protection without interrupting the data flows.
ASK INFAPreview
