Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My question is, what can be done to prevent malicious search phrases in mysql databases?

Search terms spamming example: guayabera en espa�a//?option=com_product//catalog/seo_sitemap/account//index2.php?option=c

I'm thinking of doing this in PHP by preventing a query with the ? character. Or perhaps to simply block IP addresses from using the search function. Is there a better way?

share|improve this question

Magento has some support for injection attacks and XSS, but it has been compromised in several releases in the past, so do not rely on it having sufficient stand alone protection.

Consider adding a web application firewall (naxsi) to your server, in conjunction with a IPS/IDS firewall - that would add extra protection for you and your customers.

Speak to your host, any specialised Magento host will have provisions for this in place, and if not, change host.

share|improve this answer

Magento already has a lot of code to protect you against this. The best way to protect yourself is to keep on a current version and build of Magento. (As flaws are found, Magento fixes them.)

The biggest danger is to leave old versions of Magento (or any other app) up for years at a time. Flaws are found in them all, and the only way to stay relatively safe is to stay up to date.

share|improve this answer
good to know what code I need, my version is – Luis Jun 16 '12 at 14:02
That's fairly shocking advice. Magento is a complex application and bugs are continually being found that backdate to earlier versions (even as far as 1.1). It would be very foolhardy to think that you are suitably protected just by the core-code alone. – Ben Lessani - Sonassi Jul 18 '12 at 17:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.