Secure Database Library - Revision history

Abhishek Das at 16:32, 28 July 2013

2013-07-28T16:32:13Z

Abhishek Das at 08:09, 28 July 2013

2013-07-28T08:09:06Z

Abhishek Das at 08:07, 28 July 2013

2013-07-28T08:07:22Z

Abhishek Das: First draft of Secure DB library wiki

2013-07-28T07:48:23Z

First draft of Secure DB library wiki

New page

<h4>Introduction</h4>

This library is compatible with PHP PDO, but doesn't allow insecure operations (such as concatenation of values in any form) with it. We have enforced prepared statements for all data that is to be sent to the database engine, and will enforce whitelisting (via taint tracking) of all SQL parameters (such as limit and order by) where prepared data are not supported by the back-end engine.
A base library provides all these features abstracted from database engines, and derived libraries for each common databas engine.

<h4>Usage</h4>

<ul>
<li>
Include the required database adapter wrapper class. For example, in case of PDO_MYSQL
{{{
require ('phpsec/libs/db/adapter/pdo_mysql.php');
}}}
</li>
<li>Set up a database connection
{{{
$a = new \phpsec\Database_pdo_mysql ('DATABASE_NAME', 'DATABASE_USER', 'DATABASE_PASSWORD');
}}}
</li>
<li>In case you already have a connection made, you can pass the object directly to the constructor
{{{
$pdo = new \PDO ("mysql:dbname=DATABASE_NAME;host=localhost;",'DATABASE_USER','DATABASE_PASSWORD');
$a = new \phpsec\Database_pdo_mysql ($pdo);
}}}
</li>
<li>Execute queries. Parameters can be passed as arrays or expanded lists.
{{{
$b = $a->SQL("SELECT * FROM users WHERE username = ? AND dob = ?", "abc", "09/10/1991");
$b = $a->SQL("SELECT * FROM users WHERE username = ? AND dob = ?", array("abc","09/10/1991"));
$b = $a->SQL("SELECT * FROM users WHERE username = :username AND dob = :dob", array(':username' => 'abc',':dob' => '09/10/1991'));
}}}
</li>

<h4>Files</h4>

<h5>adapter/base.php</h5>

<h6>DatabaseConfig class</h6>

A single wrapper object for all database configuration options. Easier to pass around a single object to functions than an expanded list.

<h6>DatabaseModel class</h6>

Parent class for all database wrapper classes. Provides most of the PDO compatible interface functions.

<h6>DatabaseStatementModel class</h6>

Parent class for all database prepared statements. Contains methods to actually perform queries and fetch data.

<h5>adapter/pdo_mysql.php</h5>

<h6>Database_pdo_mysql class</h6>

PDO_MySQL wrapper class. Extends the DatabaseModel class.

<h6>DatabaseStatement_pdo_mysql</h6>

PDO_MySQL prepared statement wrapper class. Extends the DatabaseStatementModel class.

<h5>adapter/pdo_pgsql.php</h5>

<h6>Database_pdo_pgsql class</h6>

PDO_PostgreSQL wrapper class. Extends the DatabaseModel class.

<h6>DatabaseStatement_pdo_pgsql</h6>

PDO_PostgreSQL prepared statement wrapper class. Extends the DatabaseStatementModel class.

<h5>adapter/pdo_sqlite.php</h5>

<h6>Database_pdo_sqlite class</h6>

PDO_SQLite wrapper class. Extends the DatabaseModel class.

<h6>DatabaseStatement_pdo_sqlite class</h6>

PDO_SQLite prepared statement wrapper class. Extends the DatabaseStatementModel class.

<h5>dbmanager.php</h5>

<h6>DatabaseManager class</h6>

This is not being used at the moment. It might be needed later for when the set of libraries would be incorporated in a framework. Leaving it for legacy purposes.

@@ Line 39: / Line 39: @@
 </code>
 </li>
+</ul>
 <h4>Files</h4>

@@ Line 2: / Line 2: @@
 This library is compatible with PHP PDO, but doesn't allow insecure operations (such as concatenation of values in any form) with it. We have enforced prepared statements for all data that is to be sent to the database engine, and will enforce whitelisting (via taint tracking) of all SQL parameters (such as limit and order by) where prepared data are not supported by the back-end engine.
-A base library provides all these features abstracted from database engines, and derived libraries for each common databas engine.
+A base library provides all these features abstracted from database engines, and derived libraries for each common database engine.
 <h4>Usage</h4>

@@ Line 8: / Line 8: @@
 <ul>
 <li>
-Include the required database adapter wrapper class. For example, in case of PDO_MYSQL
+Include the required database adapter wrapper class. For example, in case of PDO_MYSQL<br><br>
-{{{
+<code>
      require ('phpsec/libs/db/adapter/pdo_mysql.php');
-}}}
+require ('phpsec/libs/db/adapter/pdo_mysql.php');
 </li>
-<li>Set up a database connection
+<li>Set up a database connection<br><br>
-{{{
+<code>
-    $a = new \phpsec\Database_pdo_mysql ('DATABASE_NAME', 'DATABASE_USER', 'DATABASE_PASSWORD');
-}}}
+$a = new \phpsec\Database_pdo_mysql ('DATABASE_NAME', 'DATABASE_USER', 'DATABASE_PASSWORD');
 </li>
-<li>In case you already have a connection made, you can pass the object directly to the constructor
+<li>In case you already have a connection made, you can pass the object directly to the constructor<br><br>
-{{{
+<code>
-    $pdo = new \PDO ("mysql:dbname=DATABASE_NAME;host=localhost;",'DATABASE_USER','DATABASE_PASSWORD');
-    $a = new \phpsec\Database_pdo_mysql ($pdo);
+$pdo = new \PDO ("mysql:dbname=DATABASE_NAME;host=localhost;",'DATABASE_USER','DATABASE_PASSWORD');<br>
-}}}
+$a = new \phpsec\Database_pdo_mysql ($pdo);
 </li>
-<li>Execute queries. Parameters can be passed as arrays or expanded lists.
+<li>Execute queries. Parameters can be passed as arrays or expanded lists.<br><br>
-{{{
+<code>
-    $b = $a->SQL("SELECT * FROM users WHERE username = ? AND dob = ?", "abc", "09/10/1991");
-    $b = $a->SQL("SELECT * FROM users WHERE username = ? AND dob = ?", array("abc","09/10/1991"));
+$b = $a->SQL("SELECT * FROM users WHERE username = ? AND dob = ?", "abc", "09/10/1991");<br>
-    $b = $a->SQL("SELECT * FROM users WHERE username = :username AND dob = :dob", array(':username' => 'abc',':dob' => '09/10/1991'));
+$b = $a->SQL("SELECT * FROM users WHERE username = ? AND dob = ?", array("abc","09/10/1991"));<br>
-}}}
+$b = $a->SQL("SELECT * FROM users WHERE username = :username AND dob = :dob", array(':username' => 'abc',':dob' => '09/10/1991'));<br>
 </li>