Preventing SQL Injection Attacks on your Joomla! Websites

This article is extracted from:
Joomla! Web Security

Secure your Joomla! website from common security threats with this easy-to-use guide

Learn how to secure your Joomla! websites Real-world tools to protect against hacks on your site Implement disaster recovery features Set up SSL on your site Covers Joomla! 1.0 as well as 1.5

For more information, please visit:
http://www.PacktPub.com/joomla-web-security-guide/book

Joomla!, a very popular content management system (CMS) is as you may know an easy-to-deploy-and-use content management system. This ease of use has lent itself to rapid growth of both the CMS and extensions for it. You can install it on almost any host, running Linux or Windows. This highly versatile software has found itself in such lofty places as large corporate web portals, and humble places such as the simple blog.

Joomla! itself is inherently safe, but misconfigurations of the CMS, vulnerable components, hosts that are poorly configured, and weak passwords can all contribute to the downfall of your site. Hence, it's always better to ensure the security of your site.

In this article by Tom Canavan, we will take a look at how SQL injection attacks can occur to your Joomla website, how we can test for SQL injection attacks, and how to stop SQL injection.

Introduction

Mark Twain once said, "There are only two certainties in life-death and taxes." Even in web security there are two certainties: It's not "if you are attacked", but "when and how" your site will be taken advantage of.

There are several types of attacks that your Joomla! site may be vulnerable to such as CSRF, Buffer Overflows, Blind SQL Injection, Denial of Service, and others that are yet to be found.

The top issues in PHP-based websites are:

• Incorrect or invalid (intentional or unintentional) input
• Access control vulnerabilities
• Session hijacks and attempts on session IDs
• SQL Injection and Blind SQL Injection
• Incorrect or ignored PHP configuration settings
• Divulging too much in error messages and poor error handling
• Cross Site Scripting (XSS)
• Cross Site Request Forgery, that is CSRF (one-click attack)

Read more: Preventing SQL Injection Attacks on your Joomla! Websites