Scribd
Upload
4 views2 pages

1.0 SQL Introduction

The document provides an introduction to SQL, detailing its structure, important commands, and specific commands for MariaDB. It also addresses the issue of SQL injection and emphasizes the use of SQL parameters for protection against malicious code. Additionally, it includes examples of parameterized queries and type specification characters for different data types.

Uploaded by

bonawe2244
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
4 views2 pages

1.0 SQL Introduction

The document provides an introduction to SQL, detailing its structure, important commands, and specific commands for MariaDB. It also addresses the issue of SQL injection and emphasizes the use of SQL parameters for protection against malicious code. Additionally, it includes examples of parameterized queries and type specification characters for different data types.

Uploaded by

bonawe2244
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

1.

0 SQL Introduction

SQL Introduction

A SQL database contains tables. Each table has a name. Tables contain records (rows) with data.
Tables contain columns.

It's sometimes required to use a semicolon, ; after each statement.

Important SQL Commands:

SELECT - extracts data from a database


UPDATE - updates data in a database
DELETE - deletes data from a database
INSERT INTO - inserts new data into a database
CREATE DATABASE - creates a new database
ALTER DATABASE - modifies a database
CREATE TABLE - creates a new table
ALTER TABLE - modifies a table
DROP TABLE - deletes a table
CREATE INDEX - creates an index (search key)
DROP INDEX - deletes an index

MariaDB Specific

List databases:
show DATABASES;

Connect to a DB:
use [DATABASE];

List tables:
show TABLES;

Note that a lot of MariaDB commands can be correlated with "MySQL"

SQL Injection

SQL injection is the placement of malicious code in SQL statements, via web page input.

SQL injection usually occurs when you ask a user for input, like their username/userid, and instead of a
name/id, the user gives you an SQL statement that you will unknowingly run on your database.
Use SQL Parameters for Protection

SQL parameters are values that are added to an SQL query at execution time, in a controlled manner

Example

$stmt = $dbh->prepare("INSERT INTO Customers (CustomerName,Address,City) VALUES


(:nam, :add, :cit)");
$stmt->bindParam(':nam', $txtNam);
$stmt->bindParam(':add', $txtAdd);
$stmt->bindParam(':cit', $txtCit);
$stmt->execute();

Example 2:

$stmt = $dbh->prepare("INSERT INTO users (username, password) VALUES (?, ?)");


$stmt->bindParam('ss', $username, $password);
$stmt->execute();

Type specification chars

Character Description

i corresponding variable has type int

d corresponding variable has type float

s corresponding variable has type string

b corresponding variable is a blob and will be sent in packets

You might also like