SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.
315
votes
17answers
36k views
How can I explain SQL injection without technical jargon?
I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?
40
votes
6answers
6k views
SQL injection — but why isn't escape quotes safe anymore?
I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion.
Raw SQL
When you're writing SQL -- for ...
20
votes
4answers
1k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
16
votes
7answers
821 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
16
votes
1answer
2k views
Are prepared statements 100% safe against SQL injection?
Are prepared statements actually 100% safe against SQL injection, assuming all user-provided parameters are passed as query bound parameters?
Whenever I see people using the old mysql_ functions on ...
15
votes
2answers
1k views
Does an ORM framework such as hibernate completely mitigate SQL injection?
I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
14
votes
3answers
6k views
SQL injection with AND 1=1
Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university.
E.g.
select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970;
or
...
14
votes
4answers
4k views
How did anonymous use UTF-16 ASCII to fool PHP escaping?
A few months ago, anonymous took down a child pornography site using SQL-injection. I read in this article that anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
12
votes
7answers
820 views
SQL Injection Prevention
SQL Injection is always a hot topic particularly when it comes to web security.
In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
12
votes
4answers
2k views
Levraging a shell from SQL injection
As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
11
votes
3answers
1k views
How do I prevent this type of SQL injection attack?
Our company has been using several tool (Veracode, Appscan, etc) to verify that our applications meet minimum security requirements. I have inherited a legacy application which has several flaws. I've ...
11
votes
2answers
2k views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
10
votes
5answers
829 views
SQL Injection in a Non-Web Application
Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
10
votes
4answers
1k views
Does stored procedure prevent SQL Injection in postgreSQL
Is it true that Stored procedure will prevent databases to be injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injection if we only use ...
10
votes
1answer
608 views
How to properly secure a $_GET in PHP?
I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
10
votes
2answers
568 views
What are the SQL-injections issues of parameterized queries?
I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
8
votes
3answers
579 views
Suggestion setting up a SQL injection honeypot
I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ).
That made me curious ...
8
votes
6answers
4k views
xp_cmdshell: should it ever be used?
Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
7
votes
4answers
996 views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
7
votes
3answers
552 views
Should IP addresses be validated to prevent SQL Injection?
In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses.
Should I validate user IP addresses before using ...
7
votes
4answers
587 views
SQL injection Are there any instances where a vulnerable url would not contain an 'equals' (=) symbol
I have a question I'm hoping you could help with?
I am looking to filter/grep a very long list of spidered url's from my site to only get the url's that could possibly be vulnerable to sql injection.
...
7
votes
2answers
588 views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
7
votes
1answer
493 views
How to make SQL injection in PostgreSQL's tsquery?
I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format:
PHP raised unknown ...
6
votes
2answers
808 views
What is SQL injection?
What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
6
votes
2answers
8k views
How do I test for SQL injection vulnerabilities on a site with input fields?
What methods are available for testing SQL injection vulnerabilities?
6
votes
3answers
557 views
Is there any SQL injection for this PHP login example?
I want to write a login form, and I got one example from the web.
I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like?
This is ...
6
votes
2answers
645 views
Demonstrating SQL injection on the following
I've got lines in my php/mysql code which look like this:
...
$sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id'];
...
... query is executed
...
echo $price;
As a ...
6
votes
3answers
3k views
How to patch against RefRef's DOS attack
Overview
Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit Mysql using the server's ...
6
votes
2answers
338 views
SQL Injection: Drop All Tables
I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
6
votes
1answer
643 views
Do I have to make any more check if I use prepared statements for integers?
I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this:
$stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE.
...
6
votes
2answers
192 views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
5
votes
4answers
321 views
A customers site had a big mysql injection attack on it, just want to learn from it
I created an online store for a friend of mine.
I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The ...
5
votes
5answers
380 views
How to make a site vulnerable to SQLi?
I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I ...
5
votes
4answers
223 views
Does any database let you disable non-parameterized queries and therefore disable SQL injection?
Is there a database that allows this already?
If not, here is how I think it could be done. I think it would require modifying the database software and the driver or code that is assembling the SQL ...
5
votes
3answers
383 views
How do I make SQL injection harder but not impossible?
I'm doing a CTF application for my final year project. I wanted to craft a SQL injection flag but I don't wish that they can simply found out the SQLi vulnerability by injecting ' . Hence, is there ...
5
votes
1answer
3k views
Testing SQL injection using sqlmap
I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks.
I got a website which is vulnerable:
C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
5
votes
3answers
391 views
Best way to alert a website owner of a vulnerability?
recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
5
votes
2answers
725 views
What type of attacks can be used vs MongoDB?
I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
5
votes
2answers
635 views
Could this login form be “hacked” to allow access?
We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell:
$email=$_POST['email'];
...
5
votes
1answer
295 views
My site just got hit with a SQL injection attack, how can I tell what they were doing?
So a page on my site (it's a PHP page that displays newsletter articles) was vulnerable to SQL injection and got hit. I discovered it because it was doing enough database queries to cause the CPU load ...
5
votes
1answer
456 views
SQL Injection on URL, not on parameters
Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
5
votes
2answers
169 views
Possibility of SQL injection on table name that filters backticks?
I am reviewing an application that has something like this:
table_name = table_name.replace('`', '')
c.execute('SELECT * FROM `' + table_name + '`')
Is this actually exploitable if the attacker ...
5
votes
1answer
261 views
SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns
I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
4
votes
4answers
518 views
How to test for SQL injection query
When testing for SQL injection in an URL like this: example.com/videos.php?id='34, we use character sequences like:
'
"
""""
/*/
-' --
And many others...
How could you test links like these for ...
4
votes
3answers
198 views
What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?
I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query.
The sanitization routing that I'm analyzing works ...
4
votes
5answers
451 views
Are image uploads also vulnerable to sql injection?
I have some good knowledge how sql injections work. I see that the Googling inurl upload.php will tell one about the upload paths in a website. My Question is that if a person finds a path by which he ...
4
votes
3answers
338 views
Create a page to experiment with SQL injection [closed]
This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
4
votes
3answers
437 views
SQL Injection How to inject Clean/Rest URLS
I have a question I'm hoping you could help me with?
Unclean url's:
http://example.com/index.php?page=foo
http://example.com/products?category=2&pid=25
...
4
votes
1answer
180 views
Can anybody recommend any gems for checking security vulnerabilities?
I want to check one of my RoR projects for security vulnerabilities.
So can anybody recommend any gems for my needs?
