Securing and Backing Up a Database
A database often holds the most valuable thing you own. Basic protection:
- Never paste user input into SQL: use
?parameters so input can never become code (this stops SQL injection). - Least privilege: the application's database account should only be able to do what the application needs, not drop tables.
- Hash passwords; never store them as readable text.
- Encrypt sensitive data and connections, and keep secrets out of code.
- Back up regularly, keep copies in a separate place, and practise restoring: a backup you have never restored is only a hope.
SQLite can export a whole database as SQL text, which you can store and replay to rebuild it.
Examplepython
Quick check
What is the best defence against SQL injection?
Your turn: write the code
Back the database up with iterdump, restore it into a new connection, and print how many rows the restored table has.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.