https://github.com/kissssu/sqli-prevention-using-js

This project demonstrates a basic front-end approach to SQL injection prevention through client-side filtering (for educational purposes only).
https://github.com/kissssu/sqli-prevention-using-js

filtering

Last synced: 20 days ago
JSON representation

This project demonstrates a basic front-end approach to SQL injection prevention through client-side filtering (for educational purposes only).

• Host: GitHub
• URL: https://github.com/kissssu/sqli-prevention-using-js
• Owner: kissssu
• Created: 2024-12-28T14:50:46.000Z (29 days ago)
• Default Branch: main
• Last Pushed: 2024-12-29T10:08:05.000Z (28 days ago)
• Last Synced: 2024-12-29T11:18:11.601Z (28 days ago)
• Topics: filtering
• Language: JavaScript
• Homepage:
• Size: 5.86 KB
• Stars: 1
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        

# SQLi Prevention Filter (**Front-End Demonstration** )

This project demonstrates a basic front-end approach to SQL injection prevention for educational purposes. It's important to understand that **client-side filtering alone is not sufficient** to secure your application. Always implement robust server-side security measures.

## **Files:** 

* index.html: Contains the login form and basic structure of the page.

* style.css: Styles the login form and query output elements.

* script.js: Implements the logic for handling user input, filtering, and displaying the original and filtered queries.

## **Functionality:**

1. The user enters their username and password in the login form.

2. The JavaScript code constructs the original SQL query (**replace with your actual query logic**).

3. It implements a basic blacklist check for common SQL injection keywords in the username and password fields.

4. If a potential SQL injection is detected:

    - An error message is displayed to the user.

    - The user input is sanitized by escaping single quotes (**a very basic approach, not secure for production**).

5. The original and filtered queries are displayed for demonstration purposes.

## **Important Notes:**

* This is a simplified example for educational purposes only. **Do not use this code in a production environment.**

* Client-side filtering can be easily bypassed by attackers.

* The provided filtering logic is rudimentary and does not guarantee complete protection.

* The focus of this project is to understand the concepts of SQL injection and basic prevention techniques.

## **Learning Objectives:**

* Understand the vulnerabilities of SQL injection.

* Implement basic client-side filtering techniques (while acknowledging their limitations).

* Recognize the importance of server-side security measures for robust protection.

## **Server-Side Security Recommendations:**

To effectively prevent SQL injection, it's crucial to implement security measures on the server-side. Here are some recommended approaches:

* **Prepared statements (parameterized queries):** This is the most secure approach as it separates the data from the query, preventing malicious code injection.

* **Input validation and sanitization:** Validate and sanitize all user input to ensure it conforms to expected data types and formats.

## **Disclaimer:**

This code is provided as-is for educational purposes only and does not constitute professional security advice. It is your responsibility to implement appropriate security measures in your applications.