This document discusses NoSQL injection and strategies for preventing it. It begins with an introduction comparing NoSQL and SQL databases. Next, it defines NoSQL injection and how it can occur. The document then discusses various techniques for preventing NoSQL injection attacks, including reviewing code for vulnerabilities and using input validation. It also provides an example of how NoSQL injection could happen in a PHP/MongoDB application and how to validate input as a string to prevent it.

1. Web Application Security (PHP)
Zakieh Alizadeh
zakiehalizadeh@gmail.com
APA Laboratory – Ferdowsi University of Mashhad

2. Session 2
NoSQL Injection

3. NoSQL Injection
 Scenarios :
 Preventing SQL Injection Attacks
 Table of Content
 NoSQL VS SQL
 NoSQL Injection
 strategies SQL injection resulted from weak coding techniques
 Preventing SQL Injection Attacks
 Reviewing Code for SQL Injection
 Countermeasures of SQL Injection Preventing NoSQL Injection Attacks
 Reviewing Code for NoSQL Injection Countermeasures of NoSQL Injection

4. NoSQL Injection
 NoSQL VS SQL
 NoSQL Injection
 Preventing Injection Attacks

5. NoSQL Injection
SQL VS NoSQL

6. NoSQL Injection
SQL VS NoSQL

7. NoSQL Injection
SQL VS NoSQL

8. NoSQL Injection
SQL VS NoSQL

9. NoSQL Injection
SQL VS NoSQL

10. NoSQL Injection
Special case: PHP/MongoDB
• MongoDB expects input in JSON array format
find({'username‘:'Alizadeh'})
$collection->find(array('username'=>'Alizadeh’))

11. NoSQL Injection
Special case: PHP/MongoDB
find({'username':{’$ne‘ :'Alizadeh‘} })
 But PHP will automatically create associative arrays from query string input with square
brackets
page.php? params[foo]= 'Alizadeh’
$params== array(‘foo’ => 'Alizadeh’ )
• MongoDB also use associative arrays for query criteria

12. NoSQL Injection
• if you expect String : just validate “Is it String?”
$db=$dbname;
$m = new MongoClient(); // connect
$db = $m->seminar;
$collection=$db->user;
$username= (string) $_GET['username'];
$query=array('username'=>$username);
$result=$collection->find($query);
foreach ($result as $doc)
{
echo "UserName=".$doc['username'];
}

13. NoSQL Injection