Prevent Sql Injections?

[pavemen]

where i can find mod_security to install on my forum.
And what's features that this mod can do ?

it is a server modification to the apache installation. nothing to do with mybb. if you have to ask, then you should talk to your host about it and get help installing and configuring it.

[Beautiful]

mod_security won't help it can easily be bypassed

[Nathan Malcolm]

mod_security won't help it can easily be bypassed

You can bypass any WAF. In the case of scanners which are naive, or kids with little knowledge of exploitation, they do a great job. That extra bit of difficulty could give the admin enough time to patch the issue before it's successfully exploited.

[Euan T]

Yes you can. Its called PDO (PHP Data Objects ). You should be using 'prepared' statements within your projects, not MYSQL or MYSQLi. This will eliminate SQL injection completely as data is never passed directly into the SQL query.

PDO isn't a bulletproof solution for preventing SQL injection. PDO does have some features which stop developers doing stupid things, but injection is still possible if the developer truly doesn't know what they're doing.

Example: Drupal's recent security scare caused by custom code to build prepared statements with an array of parameters. 

[Cr4ckinaB0x]

lol, plugin security isn't going to help you if your code isn't right