Question

There are a lot of ways here to secure your code from SQL injection attack. But what I require is How to log sql injection attack so that we can add him(the attacker-user) in the blacklist-users database.

What I need here, is a kind of function which will return true if there’s a sql injection.

<?php
if(isset($_POST['username'])){
// need a function here which will return true if there's
// a sql injection else false
}
?>

Answer 1

You can use PHP-IDS to detect security attacks (not just SQL injection) and add custom behavior. In my case I run PHP-IDS at the start of every request. If an issue is detected, I log to the database, return a generic error message to the user and die().

Be warned though that PHP-IDS will not detect all SQL injection issues. It’s not possible to do that automatically. You still need to properly handle your queries.