{"id":2760,"date":"2026-10-06T12:30:00","date_gmt":"2026-10-06T09:30:00","guid":{"rendered":"https:\/\/narhost.com\/blog\/?p=2760"},"modified":"2026-09-26T23:17:31","modified_gmt":"2026-09-26T20:17:31","slug":"sql-injection-nedir","status":"publish","type":"post","link":"https:\/\/narhost.com\/blog\/sql-injection-nedir\/","title":{"rendered":"SQL Injection Nedir, Siteniz Neden Risk Alt\u0131nda"},"content":{"rendered":"<div id=\"ai-ozet\" class=\"ai-box\">\n<p class=\"ai-box-title\">K\u0131saca \u00f6zet<\/p>\n<ul>\n<li>SQL injection nedir sorusunun k\u0131sa cevab\u0131: kullan\u0131c\u0131dan gelen verinin veritaban\u0131 sorgusuna do\u011frudan eklenmesi y\u00fcz\u00fcnden sald\u0131rgan\u0131n sorguyu kendi istedi\u011fi komuta \u00e7evirmesidir.<\/li>\n<li>A\u00e7\u0131k bulunan bir formdan \u00fcye listesi, parola \u00f6zetleri ve sipari\u015f bilgileri okunabilir, kay\u0131tlar silinebilir ya da y\u00f6netici hesab\u0131 olu\u015fturulabilir.<\/li>\n<li>Kal\u0131c\u0131 \u00e7\u00f6z\u00fcm kodda yap\u0131l\u0131r: haz\u0131rlanm\u0131\u015f ifadeler (prepared statements) sorgu ile veriyi birbirinden ay\u0131r\u0131r ve a\u00e7\u0131\u011f\u0131 k\u00f6kten kapat\u0131r.<\/li>\n<li>WordPress gibi haz\u0131r yaz\u0131l\u0131mlarda a\u00e7\u0131klar\u0131n b\u00fcy\u00fck k\u0131sm\u0131 eklenti ve temalardan gelir; g\u00fcncel s\u00fcr\u00fcm ve az eklenti riskin \u00e7o\u011funu keser.<\/li>\n<li>Web uygulamas\u0131 g\u00fcvenlik duvar\u0131 (WAF) bilinen sald\u0131r\u0131 kal\u0131plar\u0131n\u0131 filtreler ama kodu d\u00fczeltmez; ikinci katmand\u0131r.<\/li>\n<li>Sitenin veritaban\u0131 kullan\u0131c\u0131s\u0131na yaln\u0131z ihtiya\u00e7 duydu\u011fu yetkiyi vermek, a\u00e7\u0131k istismar edilse bile zarar\u0131 s\u0131n\u0131rlar.<\/li>\n<\/ul>\n<\/div>\n<p>Siteniz bir g\u00fcn yava\u015flad\u0131, y\u00f6netim panelinde tan\u0131mad\u0131\u011f\u0131n\u0131z bir y\u00f6netici hesab\u0131 belirdi ya da m\u00fc\u015fterilerinizden &#8220;\u00fcyelik e-postan\u0131za spam geliyor&#8221; \u015fik\u00e2yetleri ba\u015flad\u0131. Bu belirtilerin arkas\u0131nda s\u0131k g\u00f6r\u00fclen nedenlerden biri SQL injection a\u00e7\u0131\u011f\u0131d\u0131r. SQL injection nedir diye sordu\u011funuzda teknik tan\u0131m k\u0131sa, ama \u00f6nemli olan k\u0131sm\u0131 \u015fu: sorun sunucuda de\u011fil, sitenizin kodunda ya da kulland\u0131\u011f\u0131n\u0131z bir eklentide ba\u015flar. Hosting firmas\u0131n\u0131 de\u011fi\u015ftirmek bu a\u00e7\u0131\u011f\u0131 kapatmaz; kodun veriyle nas\u0131l konu\u015ftu\u011funu d\u00fczeltmek kapat\u0131r.<\/p>\n<h2>SQL Injection Nedir, A\u00e7\u0131k Nas\u0131l Olu\u015fur<\/h2>\n<p>Dinamik bir web sitesi, ziyaret\u00e7inin girdi\u011fi veriyi veritaban\u0131na sorarak sayfa \u00fcretir. Arama kutusuna yaz\u0131lan kelime, giri\u015f formundaki e-posta adresi ya da adres \u00e7ubu\u011fundaki \u00fcr\u00fcn numaras\u0131 bir SQL sorgusunun i\u00e7ine yerle\u015ftirilir. Kod bu veriyi sorgu metnine d\u00fcz bir metin gibi yap\u0131\u015ft\u0131r\u0131yorsa, sald\u0131rgan veri yerine SQL komutunun bir par\u00e7as\u0131n\u0131 g\u00f6nderebilir. Veritaban\u0131 bu metni veri olarak de\u011fil, komutun devam\u0131 olarak okur.<\/p>\n<p>Kavramsal bir \u00f6rnekle d\u00fc\u015f\u00fcnelim. Giri\u015f formu, &#8220;e-postas\u0131 \u015fu olan ve parolas\u0131 \u015fu olan kullan\u0131c\u0131y\u0131 getir&#8221; diye bir sorgu kuruyor. Sald\u0131rgan e-posta alan\u0131na \u00f6yle bir metin yazar ki sorgudaki t\u0131rnak kapan\u0131r ve arkas\u0131na her zaman do\u011fru d\u00f6nen bir ko\u015ful eklenir. Sonu\u00e7ta parola kontrol\u00fc devre d\u0131\u015f\u0131 kal\u0131r ve veritaban\u0131 ilk kullan\u0131c\u0131y\u0131, \u00e7o\u011fu zaman y\u00f6neticiyi, geri d\u00f6nd\u00fcr\u00fcr. A\u00e7\u0131\u011f\u0131n \u00f6z\u00fc budur: veri ile komut aras\u0131ndaki s\u0131n\u0131r\u0131n kaybolmas\u0131.<\/p>\n<div class=\"highlight-box\">\n<p class=\"label\">Bilgi<\/p>\n<p>SQL injection yeni bir sald\u0131r\u0131 de\u011fildir; yirmi y\u0131l\u0131 a\u015fk\u0131n s\u00fcredir bilinir ve <a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/SQL_Injection_Prevention_Cheat_Sheet.html\" title=\"OWASP SQL Injection Prevention Cheat Sheet \u2014 resm\u00ee korunma rehberi\" target=\"_blank\" rel=\"noopener\">OWASP&#8217;\u0131n SQL injection \u00f6nleme rehberinde<\/a> korunma y\u00f6ntemleri a\u00e7\u0131k\u00e7a yaz\u0131l\u0131d\u0131r. H\u00e2l\u00e2 yayg\u0131n olmas\u0131n\u0131n nedeni, eski kodun ve bak\u0131m\u0131 b\u0131rak\u0131lm\u0131\u015f eklentilerin y\u0131llarca yay\u0131nda kalmas\u0131d\u0131r.<\/p>\n<\/div>\n<h2>A\u00e7\u0131k Nerelerde G\u00f6r\u00fcl\u00fcr<\/h2>\n<p>SQL injection a\u00e7\u0131\u011f\u0131 yaln\u0131zca giri\u015f formunda aranmaz. Veritaban\u0131na giden her girdi bir kap\u0131d\u0131r. Arama kutular\u0131, filtreleme ve s\u0131ralama parametreleri, adres \u00e7ubu\u011fundaki kimlik numaralar\u0131, \u00e7erez de\u011ferleri, hatta HTTP ba\u015fl\u0131klar\u0131 bile sorguya ekleniyorsa risk ta\u015f\u0131r. \u00d6zellikle s\u0131ralama parametresi gibi tablo ya da s\u00fctun ad\u0131 ta\u015f\u0131yan alanlar, geli\u015ftiricilerin en s\u0131k g\u00f6zden ka\u00e7\u0131rd\u0131\u011f\u0131 yerlerdir.<\/p>\n<p>Haz\u0131r i\u00e7erik y\u00f6netim sistemlerinde \u00e7ekirdek genellikle iyi test edilir. A\u00e7\u0131klar\u0131n \u00e7o\u011fu eklentilerde, temalarda ve \u00f6zel yaz\u0131lm\u0131\u015f k\u00fc\u00e7\u00fck mod\u00fcllerde \u00e7\u0131kar. Uzun s\u00fcredir g\u00fcncellenmeyen bir form eklentisi ya da bir ajans\u0131n y\u0131llar \u00f6nce yaz\u0131p b\u0131rakt\u0131\u011f\u0131 \u00f6zel bir sorgu, sitenin en zay\u0131f halkas\u0131d\u0131r.<\/p>\n<h2>Sald\u0131rgan Bu A\u00e7\u0131kla Neler Yapabilir<\/h2>\n<p>Etkinin b\u00fcy\u00fckl\u00fc\u011f\u00fc, a\u00e7\u0131\u011f\u0131n bulundu\u011fu sorguya ve sitenin veritaban\u0131 kullan\u0131c\u0131s\u0131n\u0131n yetkisine ba\u011fl\u0131d\u0131r. A\u015fa\u011f\u0131daki tablo tipik sonu\u00e7lar\u0131 ve sizin taraf\u0131n\u0131zda nas\u0131l g\u00f6r\u00fcnece\u011fini \u00f6zetliyor.<\/p>\n<table>\n<thead>\n<tr>\n<th>Sald\u0131rgan\u0131n elde etti\u011fi<\/th>\n<th>Sizin g\u00f6rece\u011finiz belirti<\/th>\n<th>\u0130\u015f etkisi<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u00dcye ve m\u00fc\u015fteri tablosunu okuma<\/td>\n<td>\u00c7o\u011fu zaman hi\u00e7bir belirti yok<\/td>\n<td>Ki\u015fisel veri s\u0131z\u0131nt\u0131s\u0131, bildirim y\u00fck\u00fcml\u00fcl\u00fc\u011f\u00fc<\/td>\n<\/tr>\n<tr>\n<td>Parola \u00f6zetlerini \u00e7ekme<\/td>\n<td>M\u00fc\u015fteri hesaplar\u0131nda \u015f\u00fcpheli giri\u015fler<\/td>\n<td>Hesap ele ge\u00e7irme, itibar kayb\u0131<\/td>\n<\/tr>\n<tr>\n<td>Kay\u0131t ekleme veya de\u011fi\u015ftirme<\/td>\n<td>Yeni y\u00f6netici hesab\u0131, de\u011fi\u015fmi\u015f fiyatlar<\/td>\n<td>Site kontrol\u00fcn\u00fcn kayb\u0131<\/td>\n<\/tr>\n<tr>\n<td>Kay\u0131t silme<\/td>\n<td>Bo\u015f sayfalar, eksik sipari\u015fler<\/td>\n<td>Veri kayb\u0131, yedekten d\u00f6n\u00fc\u015f<\/td>\n<\/tr>\n<tr>\n<td>Sayfalara zararl\u0131 kod g\u00f6mme<\/td>\n<td>Ziyaret\u00e7ilerin ba\u015fka sitelere y\u00f6nlenmesi<\/td>\n<td>Arama motoru uyar\u0131s\u0131, trafik kayb\u0131<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>En tehlikeli senaryo ilk sat\u0131rd\u0131r, \u00e7\u00fcnk\u00fc sessizdir. Sald\u0131rgan veriyi okur ve gider; siteniz \u00e7al\u0131\u015fmaya devam eder. Aylar sonra m\u00fc\u015fteri verileriniz ba\u015fka bir yerde ortaya \u00e7\u0131kt\u0131\u011f\u0131nda iz s\u00fcrmek \u00e7ok daha zordur.<\/p>\n<div class=\"senaryo-block\">\n<p class=\"label\">\u00d6rnek senaryo<\/p>\n<p>Yedek par\u00e7a satan k\u00fc\u00e7\u00fck bir e-ticaret sitesi, \u00fcr\u00fcnleri filtrelemek i\u00e7in y\u0131llar \u00f6nce yazd\u0131r\u0131lm\u0131\u015f bir eklenti kullan\u0131yor. Eklentinin geli\u015ftiricisi iki y\u0131ld\u0131r g\u00fcncelleme yay\u0131mlam\u0131yor. Otomatik taray\u0131c\u0131lar filtre parametresindeki a\u00e7\u0131\u011f\u0131 buluyor ve \u00fcye tablosu kopyalan\u0131yor. \u0130\u015fletme bunu \u00fc\u00e7 ay sonra, m\u00fc\u015fterilerinden gelen oltalama \u015fik\u00e2yetleriyle fark ediyor. Eklenti kald\u0131r\u0131l\u0131yor, t\u00fcm m\u00fc\u015fteri parolalar\u0131 s\u0131f\u0131rlan\u0131yor, olay hukuk dan\u0131\u015fman\u0131yla birlikte de\u011ferlendiriliyor. Yeni eklentiyi se\u00e7erken ilk \u00f6l\u00e7\u00fct son g\u00fcncelleme tarihi oluyor.<\/p>\n<\/div>\n<figure class=\"nh-sema\"><img loading=\"lazy\" src=\"https:\/\/narhost.com\/blog\/wp-content\/uploads\/2026\/09\/sql-injection-nedir-sema-narhost.webp\" alt=\"sql injection nedir sorusunu haz\u0131rlanm\u0131\u015f ifade, g\u00fcncel yaz\u0131l\u0131m, en az yetkili veritaban\u0131 kullan\u0131c\u0131s\u0131 ve WAF katmanlar\u0131yla a\u00e7\u0131klayan \u015fema\" width=\"1200\" height=\"500\" loading=\"lazy\" decoding=\"async\"><figcaption>SQL injection riskini d\u00fc\u015f\u00fcren d\u00f6rt katman: kodda haz\u0131rlanm\u0131\u015f ifade, g\u00fcncel eklenti, en az yetki ve web uygulamas\u0131 g\u00fcvenlik duvar\u0131.<\/figcaption><\/figure>\n<h2>SQL Injection&#8217;dan Korunman\u0131n Katmanlar\u0131<\/h2>\n<p>Korunma tek bir ayarla olmaz; birbirini tamamlayan katmanlarla olur. Kod katman\u0131 a\u00e7\u0131\u011f\u0131 k\u00f6kten kapat\u0131r, di\u011ferleri ka\u00e7an bir hatan\u0131n etkisini azalt\u0131r.<\/p>\n<p><strong>Haz\u0131rlanm\u0131\u015f ifadeler.<\/strong> Sorgunun kal\u0131b\u0131 \u00f6nce veritaban\u0131na g\u00f6nderilir, kullan\u0131c\u0131 verisi ayr\u0131 bir parametre olarak eklenir. Veritaban\u0131 bu parametreyi ne i\u00e7erirse i\u00e7ersin komut olarak de\u011fil, veri olarak i\u015fler. PHP&#8217;de bu y\u00f6ntem PDO ve MySQLi ile do\u011frudan desteklenir; <a href=\"https:\/\/www.php.net\/manual\/en\/pdo.prepared-statements.php\" title=\"PHP resm\u00ee dok\u00fcmantasyonu \u2014 PDO prepared statements\" target=\"_blank\" rel=\"noopener\">PHP dok\u00fcmantasyonundaki haz\u0131rlanm\u0131\u015f ifadeler b\u00f6l\u00fcm\u00fc<\/a> kal\u0131b\u0131 g\u00f6steriyor. \u00d6rne\u011fin <code>SELECT * FROM uyeler WHERE eposta = ?<\/code> bi\u00e7imindeki sorguda soru i\u015faretinin yerine gelen de\u011fer hi\u00e7bir ko\u015fulda sorgunun yap\u0131s\u0131n\u0131 de\u011fi\u015ftiremez.<\/p>\n<p><strong>G\u00fcncel yaz\u0131l\u0131m.<\/strong> WordPress \u00e7ekirde\u011fini, eklentileri ve temalar\u0131 g\u00fcncel tutmak, bilinen a\u00e7\u0131klara yay\u0131mlanan yamalar\u0131 uygular. Kullanmad\u0131\u011f\u0131n\u0131z eklentiyi pasif b\u0131rakmak yetmez; sunucuda duran kod h\u00e2l\u00e2 \u00e7a\u011fr\u0131labilir, silmek gerekir.<\/p>\n<p><strong>En az yetkili veritaban\u0131 kullan\u0131c\u0131s\u0131.<\/strong> Sitenin ba\u011fland\u0131\u011f\u0131 veritaban\u0131 kullan\u0131c\u0131s\u0131 yaln\u0131z kendi veritaban\u0131na ve yaln\u0131z gereken i\u015flemlere yetkili olmal\u0131d\u0131r. cPanel&#8217;de veritaban\u0131 ve kullan\u0131c\u0131 olu\u015ftururken yetkilerin nas\u0131l se\u00e7ildi\u011fi <a href=\"https:\/\/narhost.com\/destek\/sifirdan-cpanel-mysql-veritabani-nasil-kurulur\/\" title=\"S\u0131f\u0131rdan cPanel MySQL Veritaban\u0131 Nas\u0131l Kurulur \u2014 Narhost Destek Merkezi\">cPanel MySQL veritaban\u0131 kurulum kart\u0131nda<\/a> anlat\u0131l\u0131yor.<\/p>\n<p><strong>Web uygulamas\u0131 g\u00fcvenlik duvar\u0131.<\/strong> WAF, isteklerdeki bilinen sald\u0131r\u0131 kal\u0131plar\u0131n\u0131 sunucuya ula\u015fmadan durdurur. Yeni ya da gizlenmi\u015f varyasyonlar\u0131 her zaman yakalayamaz; <a href=\"https:\/\/narhost.com\/blog\/waf-gerekir-mi\/\" title=\"WAF Gerekir mi \u2014 Narhost Blog\">WAF gerekir mi yaz\u0131s\u0131<\/a> hangi durumda ek bir katman\u0131n ger\u00e7ekten fark yaratt\u0131\u011f\u0131n\u0131 tart\u0131\u015f\u0131yor.<\/p>\n<div class=\"warn-box\">\n<p class=\"label\">Dikkat<\/p>\n<p>Kullan\u0131c\u0131 girdisinden t\u0131rnak i\u015faretlerini silmek ya da ka\u00e7\u0131\u015f fonksiyonuyla i\u015faretlemek haz\u0131rlanm\u0131\u015f ifadenin yerini tutmaz. Karakter seti farklar\u0131 ve say\u0131sal alanlar gibi durumlarda bu y\u00f6ntemler a\u015f\u0131labilir. Kal\u0131c\u0131 \u00e7\u00f6z\u00fcm, veri ile sorguyu yap\u0131sal olarak ay\u0131rmakt\u0131r.<\/p>\n<\/div>\n<h2>Sitenizde A\u00e7\u0131k Olup Olmad\u0131\u011f\u0131n\u0131 Nas\u0131l Anlars\u0131n\u0131z<\/h2>\n<p>Kendi sitenize sald\u0131r\u0131 denemesi yapmak yerine \u00f6nce envanter \u00e7\u0131kar\u0131n. Hangi eklentiler y\u00fckl\u00fc, en son ne zaman g\u00fcncellenmi\u015f, hangisinin geli\u015ftiricisi h\u00e2l\u00e2 aktif? \u00d6zel yaz\u0131lm\u0131\u015f kod varsa geli\u015ftiricinize veritaban\u0131 sorgular\u0131nda haz\u0131rlanm\u0131\u015f ifade kullan\u0131p kullanmad\u0131\u011f\u0131n\u0131 do\u011frudan sorun. Sunucu eri\u015fim kay\u0131tlar\u0131nda arama ya da filtre parametrelerine gelen, SQL anahtar kelimeleri i\u00e7eren tekrar eden istekler de bir i\u015farettir.<\/p>\n<p>Belirti g\u00f6rd\u00fcyseniz ya da a\u00e7\u0131k istismar edildiyse temizlik ayr\u0131 bir i\u015ftir: a\u00e7\u0131\u011f\u0131 kapatmak, eklenen hesaplar\u0131 silmek, parolalar\u0131 s\u0131f\u0131rlamak ve gerekirse temiz yedekten d\u00f6nmek. Bu s\u0131ran\u0131n tamam\u0131 <a href=\"https:\/\/narhost.com\/blog\/site-hacklenirse-ne-yapmali\/\" title=\"Site Hacklenirse Ne Yapmal\u0131 \u2014 Narhost Blog\">site hacklenirse ne yapmal\u0131 rehberinde<\/a> var.<\/p>\n<h2>Hosting Se\u00e7imi Bu Riske Ne Katar<\/h2>\n<p>Hosting sa\u011flay\u0131c\u0131s\u0131 sitenizin kodundaki a\u00e7\u0131\u011f\u0131 kapatamaz; bu, geli\u015ftiricinin ve site sahibinin sorumlulu\u011fudur. Sa\u011flay\u0131c\u0131n\u0131n katk\u0131s\u0131 etraf\u0131ndaki katmandad\u0131r: hesaplar\u0131n birbirinden yal\u0131t\u0131lmas\u0131, g\u00fcncel PHP s\u00fcr\u00fcmlerinin sunulmas\u0131, sunucu d\u00fczeyinde g\u00fcvenlik yaz\u0131l\u0131m\u0131 ve geri d\u00f6n\u00fclebilir yedek. Payla\u015f\u0131ml\u0131 hostingte bu katman\u0131 sa\u011flay\u0131c\u0131 y\u00f6netir. VPS&#8217;te ise web sunucusu, veritaban\u0131 sunucusu ve g\u00fcvenlik duvar\u0131 ayarlar\u0131 sizin elinizdedir. Sa\u011flay\u0131c\u0131 ve site sahibi aras\u0131ndaki bu i\u015f b\u00f6l\u00fcm\u00fcn\u00fcn b\u00fct\u00fcn resmi <a href=\"https:\/\/narhost.com\/blog\/web-sitesi-guvenligi-onlemleri\/\" title=\"Web Sitesi G\u00fcvenli\u011fi \u00d6nlemleri \u2014 Narhost Blog\">web sitesi g\u00fcvenli\u011fi \u00f6nlemleri yaz\u0131s\u0131nda<\/a> duruyor.<\/p>\n<div class=\"success-box\">\n<p class=\"label\">Sonu\u00e7<\/p>\n<p>SQL injection nedir sorusunun pratik kar\u015f\u0131l\u0131\u011f\u0131: veriyle komutu kar\u0131\u015ft\u0131ran kodun bedelidir. Haz\u0131rlanm\u0131\u015f ifadeler a\u00e7\u0131\u011f\u0131 k\u00f6kten kapat\u0131r, g\u00fcncel eklentiler bilinen a\u00e7\u0131klar\u0131 temizler, en az yetkili veritaban\u0131 kullan\u0131c\u0131s\u0131 ve WAF ise ka\u00e7an bir hatan\u0131n etkisini k\u00fc\u00e7\u00fclt\u00fcr. D\u00f6rt katmandan ilk ikisi olmadan di\u011ferleri yaln\u0131zca zaman kazand\u0131r\u0131r.<\/p>\n<\/div>\n<h2>Kontrol Listesi, Veritaban\u0131 G\u00fcvenli\u011fi<\/h2>\n<ul class=\"kontrol-listesi\">\n<li>Y\u00fckl\u00fc eklenti ve temalar\u0131 listeleyin, son g\u00fcncelleme tarihi bir y\u0131l\u0131 ge\u00e7enleri de\u011fi\u015ftirin.<\/li>\n<li>Kullanmad\u0131\u011f\u0131n\u0131z eklenti ve temalar\u0131 pasif b\u0131rakmak yerine silin.<\/li>\n<li>\u00d6zel kod yazd\u0131rd\u0131ysan\u0131z geli\u015ftiriciden haz\u0131rlanm\u0131\u015f ifade kulland\u0131\u011f\u0131n\u0131n yaz\u0131l\u0131 teyidini al\u0131n.<\/li>\n<li>Sitenin veritaban\u0131 kullan\u0131c\u0131s\u0131n\u0131n yaln\u0131z kendi veritaban\u0131na yetkili oldu\u011funu kontrol edin.<\/li>\n<li>Veritaban\u0131 y\u00f6netici parolas\u0131n\u0131 site parolas\u0131ndan farkl\u0131 ve uzun tutun.<\/li>\n<li>Veritaban\u0131 yede\u011fini d\u00fczenli indirin ve bir kez geri y\u00fcklemeyi deneyin.<\/li>\n<li>PHP s\u00fcr\u00fcm\u00fcn\u00fc desteklenen bir s\u00fcr\u00fcmde tutun.<\/li>\n<\/ul>\n<div class=\"kb-faq\">\n<h2>S\u0131k\u00e7a sorulan sorular<\/h2>\n<h3>SQL injection nedir, sadece b\u00fcy\u00fck siteler mi hedef olur?<\/h3>\n<p>Hay\u0131r. Sald\u0131r\u0131lar\u0131n b\u00fcy\u00fck k\u0131sm\u0131 otomatik taray\u0131c\u0131larla yap\u0131l\u0131r; bu ara\u00e7lar siteyi b\u00fcy\u00fckl\u00fc\u011f\u00fcne g\u00f6re de\u011fil, a\u00e7\u0131k bar\u0131nd\u0131r\u0131p bar\u0131nd\u0131rmad\u0131\u011f\u0131na g\u00f6re se\u00e7er. Bilinen bir eklenti a\u00e7\u0131\u011f\u0131 yay\u0131mland\u0131\u011f\u0131nda o eklentiyi kullanan binlerce k\u00fc\u00e7\u00fck site ayn\u0131 g\u00fcn taran\u0131r. Az ziyaret\u00e7isi olan bir kurumsal site de, ileti\u015fim formu olan bir blog da ayn\u0131 riski ta\u015f\u0131r.<\/p>\n<h3>WordPress kullan\u0131yorsam SQL injection riskim var m\u0131?<\/h3>\n<p>WordPress \u00e7ekirde\u011fi veritaban\u0131 eri\u015fiminde haz\u0131rlanm\u0131\u015f sorgu mekanizmas\u0131 sunar ve d\u00fczenli g\u00fcvenlik g\u00fcncellemesi al\u0131r. Risk \u00e7o\u011funlukla eklenti ve temalardan gelir, \u00f6zellikle bu mekanizmay\u0131 kullanmayan ya da bak\u0131m\u0131 b\u0131rak\u0131lm\u0131\u015f olanlardan. Az say\u0131da, aktif geli\u015ftirilen eklenti kullanmak ve otomatik g\u00fcncellemeleri a\u00e7mak riskin b\u00fcy\u00fck b\u00f6l\u00fcm\u00fcn\u00fc azalt\u0131r.<\/p>\n<h3>G\u00fcvenlik eklentisi SQL injection a\u00e7\u0131\u011f\u0131n\u0131 kapat\u0131r m\u0131?<\/h3>\n<p>Kapatmaz, ama baz\u0131 sald\u0131r\u0131 denemelerini engelleyebilir. G\u00fcvenlik eklentileri ve g\u00fcvenlik duvarlar\u0131 istekleri bilinen kal\u0131plara g\u00f6re s\u00fczer. A\u00e7\u0131k kodun i\u00e7inde durdu\u011fu s\u00fcrece farkl\u0131 bir istek bi\u00e7imiyle istismar edilebilir. Eklenti ek bir katmand\u0131r; kal\u0131c\u0131 \u00e7\u00f6z\u00fcm a\u00e7\u0131\u011f\u0131 i\u00e7eren eklentiyi g\u00fcncellemek ya da kald\u0131rmakt\u0131r.<\/p>\n<h3>A\u00e7\u0131k istismar edildiyse ilk ne yap\u0131lmal\u0131?<\/h3>\n<p>\u00d6nce a\u00e7\u0131\u011f\u0131 bar\u0131nd\u0131ran bile\u015feni devre d\u0131\u015f\u0131 b\u0131rak\u0131n ya da g\u00fcncelleyin. Ard\u0131ndan y\u00f6netici hesaplar\u0131n\u0131 kontrol edip tan\u0131mad\u0131klar\u0131n\u0131z\u0131 silin, t\u00fcm y\u00f6netici ve veritaban\u0131 parolalar\u0131n\u0131 de\u011fi\u015ftirin. Veri de\u011fi\u015ftirildiyse temiz bir yedekten d\u00f6n\u00fcn. M\u00fc\u015fteri verisi okunmu\u015f olabilirse ki\u015fisel veri ihlali a\u00e7\u0131s\u0131ndan durumu hukuk dan\u0131\u015fman\u0131n\u0131zla de\u011ferlendirin.<\/p>\n<h3>SQL injection ile XSS ayn\u0131 \u015fey mi?<\/h3>\n<p>De\u011fil. SQL injection sunucu taraf\u0131nda veritaban\u0131 sorgusunu hedef al\u0131r ve veriyi okumaya ya da de\u011fi\u015ftirmeye y\u00f6neliktir. XSS ise ziyaret\u00e7inin taray\u0131c\u0131s\u0131nda \u00e7al\u0131\u015fan betik enjeksiyonudur ve oturum bilgisi \u00e7almaya ya da sayfay\u0131 de\u011fi\u015ftirmeye y\u00f6neliktir. K\u00f6kleri benzerdir; ikisinde de kullan\u0131c\u0131 verisine gere\u011finden fazla g\u00fcvenilmi\u015ftir.<\/p>\n<\/div>\n<div class=\"cta-box\">\n<p class=\"label\">Narhost&#8217;ta<\/p>\n<p>Web hosting paketlerimizde PHP 5.6 ile 8.4 aras\u0131nda s\u00fcr\u00fcm se\u00e7imi, cPanel&#8217;den yetkisi ayarlanabilir MySQL kullan\u0131c\u0131lar\u0131 ve haftal\u0131k yedekleme bulunur.<\/p>\n<p><a class=\"cta-btn\" href=\"https:\/\/narhost.com\/web-hosting\" title=\"Narhost Web Hosting paketleri\">Web hosting paketlerini incele<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>SQL injection nedir sorusunun k\u0131sa cevab\u0131: kullan\u0131c\u0131dan gelen verinin veritaban\u0131 sorgusuna do\u011frudan eklenmesi y\u00fcz\u00fcnden sald\u0131rgan\u0131n sorguyu kendi komutuna \u00e7evirmesidir. A\u00e7\u0131\u011f\u0131n nerede olu\u015ftu\u011fu ve hangi katmanlar\u0131n korudu\u011fu bu rehberde.<\/p>\n","protected":false},"author":1,"featured_media":2761,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-2760","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik"],"_links":{"self":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2760","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/comments?post=2760"}],"version-history":[{"count":1,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2760\/revisions"}],"predecessor-version":[{"id":2762,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/2760\/revisions\/2762"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media\/2761"}],"wp:attachment":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media?parent=2760"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/categories?post=2760"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/tags?post=2760"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}