The short answer: SQL injection and XSS are two of the oldest attacks on websites, and they still work because they come from the same oversight: trusting what the visitor types. If your site is built with WordPress and maintained plugins, the risk is with whoever maintains them, and your job is to update. If it is custom-built, this article’s questions are for whoever programmed it.
SQL injection
A search form puts what the visitor types inside a question to the database. If the program builds it by joining text, the visitor can type something that changes the question itself, for example to see other customers’ data or delete tables. The defence is simple and well known: prepared statements, which keep the question and the data apart. In PHP, with PDO:
$st = $pdo->prepare("SELECT * FROM customers WHERE email = ?");
$st->execute([$email]);
What you must never do is join the variable to the query text.
XSS (cross-site scripting)
If a page shows what someone wrote (a comment, a name) without protecting it, that someone can write code that then runs in the browser of whoever visits the page: stealing a session, showing a fake form, redirecting. The defence is to escape everything you display. In PHP:
echo htmlspecialchars($name, ENT_QUOTES, 'UTF-8');
In WordPress, the functions esc_html() and esc_attr() do the same.
Questions to ask your developer
| 1 |
“Do the database queries use parameters (prepared statements)?” If the answer is hesitant, that is a sign.
|
|
| 2 |
“Is everything displayed on the page escaped?” That includes what comes from forms, from the address and from the database.
|
|
| 5 |
“Who updates the libraries and PHP?” Many attacks use known flaws in old versions.
|
|
What the hosting does and does not do
A web application firewall, such as ModSecurity, blocks many requests that look like these attacks. It is a safety net, not an excuse for poor programming: see ModSecurity and web application firewalls. Security headers also help limit the damage of an XSS: Security headers explained.
|
Have a custom-built site and want to know whether you should ask something? Open a ticket describing how it was built.
Open a support ticket
|
RECOMMENDED PRODUCT Web hosting with cPanel Domain and SSL included, daily backups and the panel you already know. from KSh858.00/mo (3-year plan, with coupon) See plans |
Angola
Brasil
Kenya
Moçambique
Nigeria
Portugal
South Africa
United Kingdom
United States
International
