SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.
6
votes
1answer
630 views
Do I have to make any more check if I use prepared statements for integers?
I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this:
$stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE.
...
40
votes
6answers
6k views
SQL injection — but why isn't escape quotes safe anymore?
I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion.
Raw SQL
When you're writing SQL -- for ...
14
votes
3answers
5k views
SQL injection with AND 1=1
Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university.
E.g.
select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970;
or
...
3
votes
2answers
2k views
Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?
I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
2
votes
4answers
1k views
Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?
I'm working in a web site that doesn't use parameters on SQL queries.
All the queries are adhoc and the way they are doing the input validation seems good to me, I'm not able to break it to do SQL ...
4
votes
2answers
488 views
Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?
In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb):
1 or sleep(TIME)#
" or sleep(TIME)#
' or ...
12
votes
4answers
2k views
Levraging a shell from SQL injection
As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
10
votes
2answers
565 views
What are the SQL-injections issues of parameterized queries?
I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
2
votes
1answer
223 views
How to evade a signature to detect “xp_cmdshell” for SQLi?
What methods can be used to bypass a signature which detects "xp_cmdshell"?
10
votes
5answers
822 views
SQL Injection in a Non-Web Application
Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
5
votes
1answer
456 views
SQL Injection on URL, not on parameters
Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
8
votes
3answers
569 views
Suggestion setting up a SQL injection honeypot
I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ).
That made me curious ...
6
votes
2answers
643 views
Demonstrating SQL injection on the following
I've got lines in my php/mysql code which look like this:
...
$sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id'];
...
... query is executed
...
echo $price;
As a ...
3
votes
2answers
361 views
I'm Trying to Find how to Exploit my SQL Code
I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
1
vote
1answer
289 views
Is this enough to tackle script / malicious code insertion in GET, POST requests?
I've got legacy PHP code which attempts to prevent script / SQL injection with the following:
if (!empty($_POST)) {
reset($_POST);
while (list($k,$v)=each($_POST)) {
...
12
votes
7answers
815 views
SQL Injection Prevention
SQL Injection is always a hot topic particularly when it comes to web security.
In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
16
votes
7answers
820 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
15
votes
2answers
992 views
Does an ORM framework such as hibernate completely mitigate SQL injection?
I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
10
votes
4answers
1k views
Does stored procedure prevent SQL Injection in postgreSQL
Is it true that Stored procedure will prevent databases to be injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injection if we only use ...
