10 Steps to Protect Your VPS Against SQL Injection

This article provides a guide discussing how to protect your VPS against SQL injection.

What is SQL Injection?

SQL Injection is a type of cyber attack where an attacker inserts or “injects” malicious SQL code into a query through input fields, URLs, or other data entry points. If the application doesn’t properly validate or sanitize the input, the database may execute the attacker’s SQL commands.

According to MITRE’s Common Weakness Enumeration, SQL Injection, or “Improper Neutralization of Special Elements used in an SQL Command”, is the 3rd most dangerous software weakness of 2024.

Example:

Suppose a login form accepts a username and password, and builds a SQL query like this:

SELECT * FROM users WHERE username = 'input_username' AND password = 'input_password';

If an attacker enters this as the username:

' OR '1'='1

The resulting query becomes:

SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '';

Since '1'='1' is always true, the query returns data without needing valid credentials—letting the attacker log in.

Consequences:

• Unauthorized access
• Data theft or corruption
• Full control of the database in severe cases

Cybercriminals often target websites to gain access to valuable user data such as login credentials. This data could then be used for identity theft or sold on the dark web. Preventing SQL injection is an important step to secure your VPS platform against such attacks.

How to Protect Your VPS Against SQL Injection

Here’s a detailed guide on how to protect your VPS against SQL Injection attacks.

1. Understanding SQL Injection

   SQL Injection (SQLi) is a web security vulnerability where an attacker manipulates an application’s SQL queries by injecting malicious SQL code. This can lead to unauthorized access, data leakage, database corruption, or even complete server takeover.

2. Common SQL Injection Attack Types

   • Classic SQLi – Directly injecting SQL code into input fields.
   • Blind SQLi – Extracting data through boolean-based or time-based techniques.
   • Error-Based SQLi – Exploiting database errors to gain information.
   • Union-Based SQLi – Using the UNION operator to extract additional database information.

3. Securing Your VPS Against SQL Injection

   To protect your VPS against SQL Injection risks, you need a multi-layered defense approach. Follow these essential steps:

   1. Use Prepared Statements and Parameterized Queries

      Avoid constructing SQL queries with user input directly. Instead, use prepared statements with parameterized queries.

      Example (PHP with MySQLi):

      Plain text

      Copy to clipboard

      Open code in new window

      EnlighterJS 3 Syntax Highlighter

      $stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?"); $stmt->bind_param("ss", $username, $password); $stmt->execute();

      $stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?"); $stmt->bind_param("ss", $username, $password); $stmt->execute();

      $stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?"); $stmt->bind_param("ss", $username, $password); $stmt->execute();

      Why? Prepared statements prevent direct SQL manipulation by treating user input as data, not executable SQL.

   2. Sanitize and Validate Input Data

      • Whitelist allowed characters (e.g., only letters and numbers for usernames).
      • Use built-in validation functions like filter_var() in PHP.
      • Avoid allowing special SQL characters (', ;, --, /*, etc.) unless necessary.

      Example (Sanitization in PHP):

      Plain text

      Copy to clipboard

      Open code in new window

      EnlighterJS 3 Syntax Highlighter

      $username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);

      $username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);

      $username = filter_var($_POST['username'], FILTER_SANITIZE_STRING);
      

   3. Limit Database User Privileges

      • Use least privilege access. Ensure the database user account only has the necessary permissions.
      • Disable DROP, DELETE, UPDATE privileges for publicly accessible accounts.
      • Use separate accounts for different functions (e.g., a read-only account for displaying data).

   4. Disable Error Messages in Production

      Detailed SQL errors can help attackers refine their SQLi attempts.

      • Hide errors from users and log them instead.
      • In PHP, disable error reporting in production:
        Plain text

        Copy to clipboard

        Open code in new window

        EnlighterJS 3 Syntax Highlighter

        ini_set('display_errors', 0); error_reporting(0);

        ini_set('display_errors', 0); error_reporting(0);

        ini_set('display_errors', 0); error_reporting(0);

      • Use a custom error page to avoid exposing database information.

   5. Deploy a Web Application Firewall (WAF)

      A WAF (e.g., ModSecurity) can help detect and block SQL Injection attempts before they reach your application.

      Installing ModSecurity on Apache (Ubuntu/Debian):

      Plain text

      Copy to clipboard

      Open code in new window

      EnlighterJS 3 Syntax Highlighter

      sudo apt install libapache2-mod-security2 sudo a2enmod security2 sudo systemctl restart apache2

      sudo apt install libapache2-mod-security2 sudo a2enmod security2 sudo systemctl restart apache2

      sudo apt install libapache2-mod-security2 sudo a2enmod security2 sudo systemctl restart apache2

      Configure the modsecurity.conf file to enable SQL Injection detection rules.

   6. Use Intrusion Detection Systems (IDS)

      An IDS can monitor and detect suspicious activities on your VPS.

      • OSSEC (host-based intrusion detection system)
      • Snort (network intrusion prevention system)

      Example: Installing OSSEC on Ubuntu:

      Plain text

      Copy to clipboard

      Open code in new window

      EnlighterJS 3 Syntax Highlighter

      wget -qO - https://updates.atomicorp.com/installers/atomic | sudo bash

      sudo apt install ossec-hids

      wget -qO - https://updates.atomicorp.com/installers/atomic | sudo bash sudo apt install ossec-hids

      wget -qO - https://updates.atomicorp.com/installers/atomic | sudo bash
      sudo apt install ossec-hids
      

      SEE ALSO: Top 5 Security Features of Imunify360

   7. Regularly Update Software and Patches

      • Always update your web server, database, and application code to patch known vulnerabilities.
      • Use automatic security updates:
        Plain text

        Copy to clipboard

        Open code in new window

        EnlighterJS 3 Syntax Highlighter

        sudo apt update && sudo apt upgrade -y

        sudo apt update && sudo apt upgrade -y

        sudo apt update && sudo apt upgrade -y

   8. Monitor Database Activity

      Use log monitoring tools to detect abnormal database queries.

      • Enable MySQL query logging:
      Plain text

      Copy to clipboard

      Open code in new window

      EnlighterJS 3 Syntax Highlighter

      SET GLOBAL general_log = 'ON';

      SET GLOBAL log_output = 'TABLE';

      SET GLOBAL general_log = 'ON'; SET GLOBAL log_output = 'TABLE';

      SET GLOBAL general_log = 'ON';
      SET GLOBAL log_output = 'TABLE';
      

      • Use Fail2Ban to block repeated SQL Injection attempts.

      Example: Installing Fail2Ban:

      Plain text

      Copy to clipboard

      Open code in new window

      EnlighterJS 3 Syntax Highlighter

      sudo apt install fail2ban

      sudo apt install fail2ban

      sudo apt install fail2ban
      

      Configure /etc/fail2ban/jail.local to ban IPs making repeated suspicious SQL requests.

   9. Restrict Database Access

      • Bind the database to localhost if it’s not required externally.
      • In MySQL/MariaDB, modify my.cnf:
        Plain text

        Copy to clipboard

        Open code in new window

        EnlighterJS 3 Syntax Highlighter

        bind-address = 127.0.0.1

        bind-address = 127.0.0.1

        bind-address = 127.0.0.1

      • Use a VPN or private network if remote database access is needed.

   10. Conduct Regular Security Audits

       • Perform SQL Injection vulnerability scans using tools like:
       • SQLmap (automated SQLi testing tool)
       • Burp Suite (penetration testing tool)

       Example: Running SQLmap on a URL:

       Plain text

       Copy to clipboard

       Open code in new window

       EnlighterJS 3 Syntax Highlighter

       sqlmap -u "http://example.com/index.php?id=1" --dbs

       sqlmap -u "http://example.com/index.php?id=1" --dbs

       sqlmap -u "http://example.com/index.php?id=1" --dbs
       

       • Conduct penetration testing on your VPS to find vulnerabilities.

Conclusion

You now know how to protect your VPS against SQL injection.

Protecting your VPS against SQL Injection requires multiple layers of security, from coding best practices to firewall protections and continuous monitoring. Implementing prepared statements, user input validation, privilege restrictions, and security tools will help prevent SQL Injection attacks effectively.