Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel. mysql_real_escape_string is not used in admin panel.AS its used by me only.

share|improve this question

closed as not a real question by Hendrik Brummermann Mar 9 '13 at 10:04

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 0 down vote accepted

As per my knowledge its because you are not using php exit; function

you might be using this

if (!isset($_SESSION['username'])) {
        header('Location: index.php');

 mysql and other php code here without filtering

but you must use

if (!isset($_SESSION['username'])) {
        header('Location: index');


mysql and other php code here without filtering

Now any software or vulnerability scanner wont be able to check that you have loophole for sql injection. As exit function wont allow other code to be executed after itself. Still client side filtering is necessary. You could also use die function too.

share|improve this answer
You should fix the SQL injection vulnerability nonetheless by consequently using mysql_real_escape_string or preferable parameterized queries. Otherwise this is a mine, just waiting for some code reuse in a couple of years. It is important to note that the above code does not completely prevent exploiting the vulnerability: Cross site request forgery needs to be prevented, too. – Hendrik Brummermann Mar 9 '13 at 10:12