SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

6
votes
1answer
2k views

Do I have to make any more check if I use prepared statements for integers?

I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this: $stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE. ...
16
votes
3answers
18k views

SQL injection with AND 1=1

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g. select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970; or ...
4
votes
2answers
1k views

Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?

In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb): 1 or sleep(TIME)# " or sleep(TIME)# ' or ...
15
votes
4answers
7k views

Levraging a shell from SQL injection

As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
10
votes
2answers
1k views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
2
votes
1answer
257 views

How to evade a signature to detect “xp_cmdshell” for SQLi?

What methods can be used to bypass a signature which detects "xp_cmdshell"?
10
votes
5answers
2k views

SQL Injection in a Non-Web Application

Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
5
votes
1answer
609 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
8
votes
3answers
828 views

Suggestion setting up a SQL injection honeypot

I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ). That made me curious ...
3
votes
2answers
473 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
1
vote
1answer
348 views

Is this enough to tackle script / malicious code insertion in GET, POST requests?

I've got legacy PHP code which attempts to prevent script / SQL injection with the following: if (!empty($_POST)) { reset($_POST); while (list($k,$v)=each($_POST)) { ...
15
votes
7answers
2k views

SQL Injection Prevention

SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...