I am making an employment application for a company I am working for. I've got it to protect against SQL injection and some XSS techniques. My main issue is keeping sensitive information secured, like SSN and address, because the company needs that to make 1099 forms for the salesmen's taxes.
I don't know how to do this part, but should I encrypt everything and then decrypt it when it gets into the MySQL database?
This is an overly simplified answer and should be taken with a grain of salt, as most answers about security:
Use SSL everywhere.
Use a secure encryption key
For storage of encrypted data, you could use a BLOB
field, and use MySQL's built in encryption functions . Example:
update mytable set myfield = AES_ENCRYPT('some value', SHA2('your secure secret key', 512));
If you prefer to do the encryption/decryption in the application code, take a look at PHP's Mcrypt functions.
This is by no means a complete guide, but it's a start and better than doing nothing.
You may be able to learn more on https://security.stackexchange.com/
SQL query with key in it (as Wesley Murch suggests ) is not a good idea. If you do:
update mytable set myfield = AES_ENCRYPT('some value', 'your secure secret key');
... and the query gets logged (slowlog for inst.) your secure secret key is captured in plain text, which should never happen. Such a query with the secret key would be also visible when you run query like SHOW PROCESSLIST
.
Next problem where to store the secure key? In PHP file? It is again plain text.
Encrypt data:
Use private/public key encryption ( http://en.wikipedia.org/wiki/Public-key_cryptography ). PHP has quite good support for it.
If you want to learn more, you can google "user controlled encryption" or "zero knowledge privacy".
SQL inserts / XSS:
The best protection is secure app. No doubt. If you want to secure it, you can use for inst PHP IDS to detect attacks: https://github.com/PHPIDS/PHPIDS
I have quite good experience with it.
As implied in the comments, you are asking a huge question. You are going to need to research a number of separate issues:
It would be hard to address all of them in one answer. I would suggest performing some searches on this site for the topics mentioned above.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.