Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel. mysql_real_escape_string is not used in admin panel.AS its used by me only.

share|improve this question

closed as not a real question by Hendrik Brummermann Mar 9 '13 at 10:04

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 0 down vote accepted

As per my knowledge its because you are not using php exit; function

you might be using this

session_start();
if (!isset($_SESSION['username'])) {
        header('Location: index.php');

}
 mysql and other php code here without filtering

but you must use

  session_start();
if (!isset($_SESSION['username'])) {
        header('Location: index');

        exit;
}

mysql and other php code here without filtering

Now any software or vulnerability scanner wont be able to check that you have loophole for sql injection. As exit function wont allow other code to be executed after itself. Still client side filtering is necessary. You could also use die function too.

share|improve this answer
2  
You should fix the SQL injection vulnerability nonetheless by consequently using mysql_real_escape_string or preferable parameterized queries. Otherwise this is a mine, just waiting for some code reuse in a couple of years. It is important to note that the above code does not completely prevent exploiting the vulnerability: Cross site request forgery needs to be prevented, too. –  Hendrik Brummermann Mar 9 '13 at 10:12