5
votes
1answer
557 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
14
votes
7answers
1k views

SQL Injection Prevention

SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
16
votes
2answers
1k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...