MySQL is an open-source relational database management system.

learn more… | top users | synonyms

2
votes
4answers
288 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
5
votes
2answers
282 views

SQL Injection query error with backslash

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in ...
0
votes
1answer
52 views

Access MySQL via MySQL credentials, assuming no remote MySQL, FTP, or SSH access?

LAMP stack, dedicated server. I set up some MySQL users, gave them full access rights to the necessary databases, and provided the user credentials to some freelance developers. Now that the project ...
0
votes
1answer
101 views

How does one securely create a MySQL database and user via the command line?

I'm making an app whose functionality includes creating a database and its user. This is accomplished like so: mysql -e "grant all on database.* to 'user'@'localhost' identified by '$PW';" $PW is ...
-1
votes
1answer
75 views

why database show vulnerable column when i give a wrong parameter in query?

When we try for inject a website for find vulnerable column then sometimes we need to give a wrong value in the website parameter. Like www.vhul-web.com/index.php?id=1 union select 1,2,3 -- - Now ...
-1
votes
1answer
75 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
2
votes
0answers
110 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
2
votes
0answers
126 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
1
vote
0answers
72 views

Double Query injection

I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation: (select * from (select count(*), concat(0x3a,0x3a,(select ...
1
vote
0answers
49 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
0answers
103 views

Where to save digital content and prevent sharing?

I've been inspired by the answer to the question here: Location to store an encryption key It gave me a lot to think about. My friend and I are building a website and we've encountered a problem in ...
1
vote
0answers
379 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
0
votes
0answers
38 views

MySQL SQL Injection - Get User Password

I've used SQLMAP to check for SQL injection. I've managed to retrieve the name of just one database (dbInfo) However, using SQLMAP I can't enumerate anything else - where it is tables within the DB ...
0
votes
0answers
52 views

Mysql SSL handshake: symmetric key exchange with CA or server key?

I have my MySQL database set up to require server and client identify verification, with both presenting their certificates signed by the same CA (mysql user was set up with 'require X509'). ...
0
votes
0answers
79 views

How secure is a ODBC connection from MySQL(5.6) to MS Access

I have created a connection from a MySQL server (unpopulated) to Access using their ODBC driver but don't know anything about how secure this connection may or may not be. I do not have openSSL set up ...
0
votes
0answers
73 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query ...
0
votes
0answers
990 views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
0answers
245 views

HIPAA requirements for local server

I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement. Most computers will most likely have no ...
0
votes
0answers
2k views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: ...