At my workplace we're soon going to be tasked with removing
SQL injection vulnerabilities from a large code base. The application was originally written around 8 years ago and after years of bolt-ons and additional features, security is finally getting looked at. We'll be moving from using the
mysql_ extension to
PDO and prepared statements, binding parameters properly.
We're looking at around 1100 queries, a reasonable mix of
DELETE and the codebase is littered with
What things can I do to make the process easier to manage?
What other things can I do in addition to moving to prepared statements to prevent SQL injection?