I have a Single Page Application in which the browser does all the logic work.  Except for initial loading, the server is pretty much a fancy interface to the database.  The browser sends data dictionary keys, column name / value pairs, and where clauses for SELECT, for example.  The server assembles the parts into SQL, executes the queries, and replies.  NEW: In a SELECT, for example, the table name and columns pulled are from the data dictionary - the browser supplies the data dictionary key and the SELECT where clause.  This very open environment is very susceptible to SQL Injection attacks.  The goal is to prevent damage from said attacks.  Problems to be Overcome  First, as , it is impossible to paramaterize a random SELECT where clause - SELECT cannot use a prepared statements.  Second, mysqli, the library for paramaterized statements with MySQL, does not support NULL nor MySQL functions, eg, CURRENT_DATE or NOW(), as .  Proposed Solution  First, if SELECT cannot be paramterized, then execute SELECT by a user who has no DML or DDL rights.  This will prevent SQL Injection Attacks from changing the database.  Second, write a wrapper function for mysqli that will allow NULL and MySQL functions to be passed as parameters.  This will allow parameters to be easily used for all DML.  Third, shadow highly sensitive data where it cannot be seen or touched by normal queries or normal users.  This will put sensitive data, such as passwords, out of the range of attacks.  Forth, write a wrapper order to enforce the user / query type relationship.  This will ensure SELECT are executed by the select user, for example  The result of that effort is .  The question is, logically, will this approach successfully protect against SQL Injection Attacks?  Non-Answer Answers  I proposed this same question .  Due to my poor job of presentation, received answers and comments ended up focusing on spurious issues instead of addressing the (admittedly) difficult question - does this actually work?  As a reference, here are some of those comments and answers.  Use PDO's prepared statements  First, prepared statements cannot be used for all SELECTs - how does PDO help?  Second, mysqli does not accept NULL or MySQL functions - how does PDO help?  Why re-invent the wheel  If you know of an approach that overcomes these problems, I would really really like to know - this is a difficult problem.  no mysql_real_escape_string() in sight  Values should be sanitized before being passed to the database query functions.  mysql_real_escape_string() is one of a set of sanitizing functions available, for example, one would use a different sanitizer for dates.  too much work  Please share with me your know of any approach that overcomes these problems - I would really like better insight.  That said, from my setting up the whole thing again, following my notes it took between 30 and 45 minutes. No time costs incurred thereafter.  I am happy with mysqli  How are you going to prevent SQL Injection Attacks when you cannot parameterize your SELECT?  Do you expect to never use NULL when updating a column?  Every man to his own poison, but these are issues I hope to solve - not live with.  @Konerack pointing out limited number of parameters  Right.  Changed to code to use eval() (shudder) which solved the problem.  Needs security review.  The Question Again  Will this approach protect against SQL Injection Attacks while overcoming the problems of no parameterized SELECT and mysqli's parameter limitations?
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
The easy way: Install Nvidia drivers, CUDA, CUDNN and Tensorflow GPU on Ubuntu 18.04 How can I turn on the Intel HD manually? For some weeks my MacBook 6.2 does not switch to the integrated graphics adapter (Intel HD). This is especially crucial when I work on battery (which happens quite often). I guess the runtime could be enhanced when it would take the HD adapter for display.  I checked that it automatically changes the graphics mode. I am running Snow Leopard 10.6.8.  I recently installed 8GiB RAM (not from Apple). Could this probably related to this issue? Actually I do not want to downgrade or use the expensive Apple RAM.  So, how can I manually turn on the internal graphics adapter? How to get the Input and output in a terminal to a text file? I want to create a text file which will add each command I am going to run on the terminal as a new line entry in the text file. i.e., I need to keep a record of what are the things I'm doing in the terminal. Further if I can keep a record of outputs I'm getting in the terminal, along with the inputs in the terminal, as a text file, it will be much better.   Each time I forget a command I have to search again in the Internet for the command.  Can I can make a file like above? Generator of rational functions unchanged under $\sigma(X) = X + 1$ Let $L = K(X)$ be the field of rational functions over a field $K$ with characteristic $p &gt; 0$, and let $\sigma \in \operatorname{Aut}_K(L)$ with $\sigma(X) = X + 1$.   Show that $G = \left&lt;\sigma\right&gt;$ is finite, and determine a generator of $L^G = \{ f \in L: \rho(f) = f$ for all $\rho \in G \}$ over $K$.    My solution so far: $G = \left&lt;\sigma\right&gt;$ is finite because char $(K) = p &gt; 0$ and therefore $\sigma^p (X) = X + p = X $.  A rational function unchanged under $\sigma$ will also be unchanged under any $\sigma^n$, so we don't have to worry about powers of $\sigma$ I think.   Any ideas for finding a generator? Thanks. Recursive glob? I'd like to write something like this:  $ ls **.py   in order to get all .py filenames, recursively walking a directory hierarchy.  Even if there are .py files to find, the shell (bash) gives this output:  ls: cannot access **.py: No such file or directory   Any way to do what I want?  EDIT: I'd like to specify that I'm not interested in the specific case of ls, but the question is about the glob syntax. How to find and return a duplicate value in array What can you use Python generator functions for? I'm starting to learn Python and I've come across generator functions, those that have a yield statement in them.  I want to know what types of problems that these functions are really good at solving. How do I enable automatic updates? I'm looking to install 32-bit windows with IIS to dual-boot with my 64-bit edition of windows on a laptop. I have a ten gig partition on my harddrive - is this large enough for a simple Windows install and a few programs?   I've never dual booted before, so I'm not quite sure how easy it is to mess up the process. Can you recommend any tutorials on how to set up a dual-boot configuration on Windows? Imagine that you have the following list. keys = ['name', 'age', 'food'] values = ['Monty', 42, 'spam']  What is the simplest way to produce the following dictionary? a_dict = {'name': 'Monty', 'age': 42, 'food': 'spam'} Why does US Customs & Immigration ask the purpose of my trip when I'm returning home? As a US citizen, when I re-enter the US, I am often asked where I was, how long I was there, and the reason for my visit.  Why am I asked these things?  Am I required to answer? Don't I have a legal right to enter the US (as long as I'm not doing or carrying anything illegal)?  If I were to refuse to answer these questions, would I be permitted entry?  Note: I'm not really bothered by the questions (except when the agent asking them is especially rude), I'm just curious. What do the different colors mean in ls? How does the Comma Operator work How does the comma operator work in C++?  For instance, if I do:  a = b, c;     Does a end up equaling b or c?   (Yes, I know this is easy to test - just documenting on here for someone to find the answer quickly.)  Update:  This question has exposed a nuance when using the comma operator.  Just to document this:  a = b, c;    // a is set to the value of b!  a = (b, c);  // a is set to the value of c!   This question was actually inspired by a typo in code.  What was intended to be  a = b; c = d;   Turned into  a = b,    //  &lt;-  Note comma typo! c = d; Completeness and Incompleteness What would you call someone who makes no lasting impression? How can I recover a game center account where I forgot ID and password? A long time ago, I made a game center account to which I attached my CoC village. This account hasn't been used anymore, and I have forgotten the ID and the password.  Now I want to transfer that game to my new phone which has a new game center ID, but need a transfer code from the old account to do so. Is there a way to recover my old game center account details? How to stop iPhone users from sending iMessages and send SMS instead I used to have an iPhone, but I changed to an android (shock, horror!). Unfortunately Apple refuses to let me go and whenever friends message me the messages get sent as iMessages (unless they remember to specifically chnge the format). I never get these messages. They never get resent as SMSs automatically as is supposed to happen. How can I get my phone number deleted from the iMessage list. I've turned off iMessage on the old iPhone. Java: Sorting user-input array upon return TL2018 (MacTeX) and TikZ calligraphy library U.K visitor visa with very old criminal conviction - do I disclose it? I have been travelling to the U.K for 25 years at least 8-10 times a year,  receiving 5 year visas, never breaking the stay period, with no problem. I've gone through immigration with no problem till my last time in London. I was stopped for eight hours and questioned about a run with the law while I was in college. This was in the US, I was around 20, it was for a credit card use. I received a conditional discharge / probation conviction which was discharged one year later. It was stupid, I was young and in college, more than 28 years ago.  After being questioned about the issue in the US, I was allowed in. They were very polite and professional.  I was also asked if I ever changed my name: I did not change it, but one letter was added in the middle of my first and last names around 20 years ago as our names are translated from Arabic to English and before the digital biometric passports, hand written passports some times varied. It was a common thing at the time.  Now I am applying for my new 5 year visas and I intend to answer truthfully  about previous conviction (previously I answered no because my conviction was spent and I expunged my record.) I want to answer yes and explain it. Is that the right thing to do?  Should I answer yes to the question about having a different name even though it was something as simple as spelling Bryan instead of Brian or Teresa and Theresa -- not really changing it and never thought of it as a change.  I have an impeccable credit rating in the Uk and the last 28 years have never received a moving violation or ever had a run in with the law.  I made one mistake when I was very young but I am  very worried about how to go ahead. I believe honesty is the best approach, is it?