my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel. mysql_real_escape_string is not used in admin panel.AS its used by me only.
closed as not a real question by Hendrik Brummermann♦ Mar 9 '13 at 10:04
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.
As per my knowledge its because you are not using php exit; function
you might be using this
but you must use
mysql and other php code here without filtering
Now any software or vulnerability scanner wont be able to check that you have loophole for sql injection. As exit function wont allow other code to be executed after itself. Still client side filtering is necessary. You could also use die function too.