SQL Injection: zaschita Laravel prilozheniy

SQL Injection — odna iz samyh opasnyh uyazvimostey. Laravel predostavlyaet instrumenty dlya nadyozhnoy zaschity.

Kak rabotaet SQL Injection

Zloumyshlennik vnedryaet SQL-kod cherez polzovatelskiy vvod:

// Uyazvimyy kod$email = $_GET['email'];$query = "SELECT * FROM users WHERE email = '$email'";// Vvod: ' OR '1'='1

Zaschita cherez Eloquent

Eloquent avtomaticheski ispolzuet prepared statements:

// Bezopasno — parametry ekraniruyutsyaUser::where('email', $request->email)->first();

// Bezopasno — massovoe prisvaivanie s fillable$user->update($request->validated());

Query Builder

// BezopasnoDB::table('users')    ->where('email', $email)    ->where('active', true)    ->get();

// Opasno — raw vyrazheniyaDB::select("SELECT * FROM users WHERE email = '$email'");

Raw vyrazheniya: kogda nuzhny

Ispolzuyte bindings:

DB::select('SELECT * FROM users WHERE email = ?', [$email]);

Best Practices

• Nikogda ne doveryayte polzovatelskomu vvodu
• Ispolzuyte Eloquent ili Query Builder
• Validiruyte dannye pered zaprosami
• Ispolzuyte prepared statements dlya raw SQL