Commenting on the part of a query.<\/li>\n<\/ul>\nThe protection from SQL injections is not complicated and, in a nutshell, consists of keeping an eye on all sorts of data, converting numbers into numeric data type and enclosing the lines into backslashes (\\) (this method is called screening). Also, PrestaShop ORM allows to make queries without screening.<\/p>\n
Example:<\/p>\n
We have a request for information via id
SELECT<\/strong> id, name from table where id =1.<\/p>\nBut since there is no typecasting, we can transfer via SQL injections the following type of data.<\/p>\n
\/?id=1+union+select+0,concat_ws(0x3a,table_name,column_name)+from+information_s chema.columns<\/p>\n
In this case, SQL quiery will be the following:<\/p>\n
SELECT<\/strong> id, name from table where id =1 union select 0,concat_ws(0x3a,table_name,column_name) from information_schema.columns<\/p>\nMoreover, a store owner must also be aware of Blind SQL Injection that is often implemented to aquire passwords.<\/p>\n
\/?id=1+AND+555=if(ord(mid((select+pass+from+users+limit+0,1),1,1))=97,555,777)<\/p>\n
SELECT id, name from table where id =1 AND 555=if(ord(mid((select pass from users limit 0,1),1,1))=97,555,777)<\/p>\n
In case the users table contains the pass column and the first symbol of the first entry equals 97 (symbol “a”), then DBMS will return TRUE<\/strong>; otherwise, it will be FALSE<\/strong>.<\/p>\nAnother example of SQL injections is reading of the files:<\/p>\n
union select load_file('\/etc\/passwd')<\/pre>\nCross-site Scripting in PrestaShop<\/h3>\n One of the most popular types of attacks is javascript cross-site scripting. This is a type of attack that injects malicious code into a web system, forcing it to issue changed data, replace links (visible \/ hidden) or display its own advertising on the affected resource.<\/p>\n
With a combination of tags and symbols, a hacker creates such a request that the site understands and executes as a command. Once a security breach is found, they can attach malicious code to the request, which will, for example, steal cookies and send it to the hacker.<\/p>\n
Using cross-site scripting, a person can:<\/p>\n
\nIntroduce malicious code in the message.<\/li>\n Upload scripts to steal administrator cookies from a malicious domain.<\/li>\n After receiving the cookie, the attacker can log in as an administrator, which gives them a free hand for further attacks. Moreover, an attacker can connect an administrator browser and launch browser exploits.<\/li>\n<\/ul>\nMost of the vulnerabilities are associated with improper processing of data received from the outside, or insufficient data checking.<\/p>\n
To secure your PrestaShop store from cross-site scripting, one can take the following actions:<\/p>\n
1. The filter must take into account all possible character combinations. One of the simple xss vulnerability checks is the use of open and closed brackets.<\/p>\n
For example:<\/p>\n
“\/?, #” >>>> << script {()}<\/pre>\nFor security’s sake, implement the shielding the input \/ output data. To do this, you can use the built-in functions to clean the code from malicious scripts. These include such functions as htmlspecialchar ()<\/strong>, htmlentities ()<\/strong> and strip_tags ()<\/strong>, addslashes ()<\/strong>.<\/p>\n2. Set HttpOnly flag. This flag makes client cookies inaccessible through JavaScript. This setting is activated in php.ini:<\/p>\n
session.cookie_httponly = True<\/pre>\n3. Use Content Security Policy.<\/p>\n
This enables you to declare a list of sources from which you can load various data, for example, JS, CSS, images and other files. Even if the hacker manages to inject the script into a web page, it will not be executed if it does not correspond to the allowed list of sources.<\/p>\n
4. Specify encoding on each page.<\/p>\n
header (\"Content-Type: text \/ html; charset = utf-8\");<\/pre>\n5. Setting permissions on folders and files.<\/p>\n
6. Closing ports on the server. After installing and configuring the server some ports could be left open, and hackers can make use of them. Therefore, it is recommended to block or filter ports.<\/p>\n
Wrapping it up<\/h2>\n Unfortunately, there is no perfect solution and every new module, a plugin may contain problems. Therefore, always keep an eye on the data you add to the store. Even if the plugin or theme is approved and verified by the platform developers, it is better to check twice.<\/p>\n
One thing is clear – a webstore should be protected against hackers and security accidents. Therefore, it is necessary to establish appropriate security measures and use additional resources to increase security.<\/p>\n\n","protected":false},"excerpt":{"rendered":"Over the last couple of years, online retail has gained global popularity, and together with …","protected":false},"author":60,"featured_media":21265,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"image","meta":{"_acf_changed":false,"footnotes":""},"categories":[15,470,300,522],"tags":[],"class_list":["post-21262","post","type-post","status-publish","format-image","has-post-thumbnail","hentry","category-prestashop","category-prestashop-tutorial","category-prestashop-guide","category-prestashop-speed-optimization","post_format-post-format-image"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t
![\"prestashop](\"https:\/\/belvg.com\/blog\/wp-content\/uploads\/2019\/04\/prestashop-security.png\" "\\"How")
<\/a><\/p>\n![\"CRO_audit_process\"](\"https:\/\/belvg.com\/blog\/wp-content\/uploads\/2024\/07\/Get-an-audit-of-your-store.webp\" "\\"How")
![\"Introduce](\"https:\/\/belvg.com\/blog\/wp-content\/uploads\/2019\/04\/Introduce-cookies.png\" "\\"How")
<\/a><\/p>\n