SQL Injection Prevention Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:24:53Z

Point to the official site

2019-02-14T14:08:11Z

Migration to GitHub

2018-02-07T04:06:10Z

‎Defense Option 4: Escaping All User-Supplied Input: reflect absence of concrete codecs in the "active" ESAPI

2018-02-07T04:04:57Z

‎Defense Option 4: Escaping All User-Supplied Input: reflect absence of concrete codecs in the "active" ESAPI

2018-02-07T03:51:26Z

‎Defense Option 4: Escaping All User-Supplied Input: sync with project moves, use a descriptive style

2018-02-07T03:43:44Z

Avoid cross-border injection

2017-09-11T06:11:37Z

2017-09-11T06:11:07Z

‎Other Cheatsheets

2017-07-19T16:16:07Z

‎Defense Option 4: Escaping All User-Supplied Input

2017-07-19T15:40:22Z

‎Database Specific Escaping Details: i added one too many bullets, so ... removed a bullet

← Older revision		Revision as of 14:24, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.md SQL Injection Prevention Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html SQL Injection Prevention Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 180: / Line 180: @@
 * Full details on [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API ESAPI are available here on OWASP].
 * The javadoc for [http://www.javadoc.io/doc/org.owasp.esapi/esapi/2.1.0 ESAPI 2.x (Legacy) is available]. This code was migrated to GitHub in November 2014.
-* [https://github.com/ESAPI/esapi-java-legacy The legacy ESAPI for Java 2.x at GitHub] helps understand existing use of it when Javadoc seems insufficient.
+* [https://github.com/ESAPI/esapi-java-legacy The legacy ESAPI for Java at GitHub] helps understand existing use of it when Javadoc seems insufficient.
-* [https://github.com/ESAPI/esapi-java The planned ESAPI for Java 3.x GitHub] has other approaches and no tests or concrete codecs.
+* [https://github.com/ESAPI/esapi-java An attempt at another ESAPI for Java GitHub] has other approaches and no tests or concrete codecs.
 To find the javadoc specifically for the database encoders, click on the ‘Codec’ class on the left hand side. There are lots of Codecs implemented. The two Database specific codecs are OracleCodec, and MySQLCodec.

@@ Line 180: / Line 180: @@
 * Full details on [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API ESAPI are available here on OWASP].
 * The javadoc for [http://www.javadoc.io/doc/org.owasp.esapi/esapi/2.1.0 ESAPI 2.x (Legacy) is available]. This code was migrated to GitHub in November 2014.
-* [https://github.com/esapi/esapi-java-legacy The legacy ESAPI for Java 2.x at GitHub] helps understand existing use of it when Javadoc seems insufficient.
+* [https://github.com/ESAPI/esapi-java-legacy The legacy ESAPI for Java 2.x at GitHub] helps understand existing use of it when Javadoc seems insufficient.
-* [https://github.com/esapi/esapi-java The active ESAPI for Java 3.x GitHub] contains current development.
+* [https://github.com/ESAPI/esapi-java The planned ESAPI for Java 3.x GitHub] has other approaches and no tests or concrete codecs.
 To find the javadoc specifically for the database encoders, click on the ‘Codec’ class on the left hand side. There are lots of Codecs implemented. The two Database specific codecs are OracleCodec, and MySQLCodec.

@@ Line 180: / Line 180: @@
 * Full details on [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API ESAPI are available here on OWASP].
 * The javadoc for [http://www.javadoc.io/doc/org.owasp.esapi/esapi/2.1.0 ESAPI 2.x (Legacy) is available]. This code was migrated to GitHub in November 2014.
-* Directly [http://code.google.com/p/owasp-esapi-java/source/browse/#svn/trunk/src/main/java/org/owasp/esapi browse the source for ESAPI for Java 2.x (Legacy) at GitHub], which is frequently helpful if the javadoc isn't perfectly clear.
+* [https://github.com/esapi/esapi-java-legacy The legacy ESAPI for Java 2.x at GitHub] helps understand existing use of it when Javadoc seems insufficient.
-* Directly [[Https://github.com/ESAPI/esapi-java|browse browse the source for ESAPI for Java 3.x (Active) at GitHub]].
+* [https://github.com/esapi/esapi-java The active ESAPI for Java 3.x GitHub] contains current development.
 To find the javadoc specifically for the database encoders, click on the ‘Codec’ class on the left hand side. There are lots of Codecs implemented. The two Database specific codecs are OracleCodec, and MySQLCodec.
@@ Line 343: / Line 343: @@
+}
 </pre>
 PDO is the universal option. If you're connecting to a database other than MySQL, you can refer to a driver-specific second option (e.g. pg_prepare() and pg_execute() for PostgreSQL).
 = Additional Defenses =

@@ Line 285: / Line 285: @@
    where 'c' is the original non-alphanumeric character.
-This information is based on the MySQL Escape character information found here: http://mirror.yandex.ru/mirrors/ftp.mysql.com/doc/refman/5.0/en/string-syntax.html
+This information is based on the MySQL Escape character information found here: https://dev.mysql.com/doc/refman/5.7/en/string-literals.html
 ====SQL Server Escaping====

@@ Line 2: / Line 2: @@
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 = Introduction  =
@@ Line 412: / Line 414: @@
 [https://owasp.org/index.php/Dhiraj_Mishra Dhiraj Mishra] - mishra.dhiraj[at]owasp.org
-<br />
+= Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}
 [[Category:Cheatsheets]]

@@ Line 201: / Line 201: @@
 * SQL Server
 * DB2
 ====Oracle Escaping====