bhakti2256 / basic-banking-system Goto Github PK

The 39&64 lines of transaction.php allow users to enter arbitrary characters, which may lead to SQL injection vulnerabilities

The hazards of SQL injection include but are not limited to:

1. Database information leakage: The leakage of user privacy information stored in the database.
2. Web page tampering: Tampering specific web pages by manipulating the database.
3. The website is hacked and spreading malicious software: modifying the values of some fields in the database, embedding network horse links, and conducting hack attacks.
4. Database is maliciously operated: The database server is attacked, and the system administrator account of the database is tampered with.
5. The server is remotely controlled: a back door is installed. The operating system support provided by the database server allows hackers to modify or control the operating system.
6. Destroy hard disk data and paralyze the entire system.

SQL injection prevention:

1. Strict escape and filtering of input
2. Parameterized: Currently, many ORM frameworks automatically use parameterization to solve injection problems, but they also provide a "concatenation" method, so caution should be exercised when using it!
3. PDO preprocessing