Have Geek Brain

Best practices for sanitizing SQL inputs using JavaScript?

So if HTML5 gives us local SQL databases on the client side, if you want to write select or insert, you no longer have the option to misinform third party input by saying $buddski = mysql_real_escape_string($tuddski)

because the PHP parser and MySQL bridge are far away. This is a whole new world of SQLite where you compose your queries and parse your results using JavaScript.

But if you can't have your entire site database, a user who gets a corrupted or corrupted database due to a malicious injection will be pretty frustrated.

So what's the best way, in pure JavaScript, to avoid / misinform your inputs so they don't damage your custom embedded database?

Scripts? specifications? Anyone?

+2


a source to share


5 answers


Once you have complete confidence in the calculation of the client, the game is over. Even if your scripts are bulletproof, the user can still load their own scripts locally (for a benign example, see GreaseMonkey) - and access the client db themselves, bypassing your scripts.



In my opinion, the only useful client database application with an untrusted client (i.e. almost any client) is mirroring / caching parts of the main, serveride db - so that the client doesn't have to fetch data over the network on repeated requests (if such db clients are corrupted , just discard them and download the data from the server again).

+6


a source


I'm not sure about HTML5 and local databases, but on the server side, it is better to use prepared statements rather than escaping. I believe it is the same with client side databases.



+2


a source


Use prepared statements.

http://dev.w3.org/html5/webdatabase/#sql-injection

+1


a source


I think even if you sanitize your inputs with your javascript that will leave your system vulnerable to attacks. It would also be overkill if you put an input sanitizer in your javascript and put another one in your php file.

0


a source


Use Google JavaScript Html Sanitizer, available as part of the Caja distribution at: http://code.google.com/p/google-caja/

This library can be used both client-side and server-side. I am using it server side in a classic ASP project running a library under an ASP JScript node.

0


a source






More articles:


All Articles