IMPLEMENTASI AES 256 UNTUK PENCEGAHAN SQL INJECTION DI PARAMETER ALAMAT URL DI TAHAP PREPARE STATEMENT - Sabilillah Fauzal Addim (2023)
With the rapid advancement of web technology, some individual activities are carried out there. So that web applications become important as a support for individual activities on the internet in their daily lives. The danger of data leakage on websites due to SQL injection is often encountered cases and even according to the OWASP organization which is a community that discusses web applications determines that the threat of SQL injection is in 3rd place out of the top 10. The way this threat works is because the results of user input to the application are displayed in a clear and invalidated manner, this can potentially be used as an injection area for malicious SQL statements that function to extract data from the database. Therefore, the threat of SQL injection attacks has a great impact because the attacker can gain access rights to the website database and information on the website like a legitimate user. This paper presents an approach to identify and secure the values or contents in the parameters placed in the URL address highlighting 2 aspects: the first is to make the parameter values or contents confidential by encryption and the second step is to prepare SQL statements to keep the SQL query from becoming a malicious query and ensure that the parameter values bound in the query have appropriate data types and are modified in a safe form so that they are eligible for execution.