SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

6
votes
2answers
1k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
476
votes
20answers
62k views

How can I explain SQL injection without technical jargon?

I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?
16
votes
2answers
11k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
19
votes
4answers
9k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
3
votes
3answers
17k views

No single quotes is allowed, Is this SQL Injection point still exploitable?

The SQL phrase looks like this, "SELECT * from XX where id = '" + id + "'" The id variable comes directly from the GET parameter named id. And the Java web app explicitly disallowed single quote. ...
64
votes
7answers
29k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
54
votes
9answers
23k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
6
votes
1answer
432 views

SQL Injection explain this query

' 1=1 GROUP BY CONCAT_WS ('~',version(), FLOOR(rand(0)*2)) having min(0) 1>> My first question is what is CONCAT function is being used for in this query 2>> And Why do we use having min(0) in here....
16
votes
3answers
2k views

How to defeat doubling up apostrophes to create SQLi attack?

I know some developers double up apostrophes to mitigate SQLi. (This is when the input is ' so it becomes '') Is there a way to beat this? This is on MS SQl Server.
4
votes
4answers
4k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
6
votes
3answers
1k views

Best way to alert a website owner of a vulnerability?

recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
10
votes
2answers
3k views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
17
votes
4answers
9k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
9
votes
4answers
11k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
3
votes
4answers
2k views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
2
votes
2answers
10k views

Sqlmap testing HTTP headers

I was wondering whether sqlmap is able to test HTTP headers for SQL vulnerabilities. I know that if I use --level>=3 then it will automatically check for User-Agent and Referrer HTTP headers, but I ...
12
votes
2answers
1k views

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
5
votes
2answers
19k views

How to Insert data into a table with sqlmap using its sql-query command

I'm using sqlmap on a test site and I wanted to modify some of the data inside of a table. Using the switch "--sql-query". What is the correct syntax? example: is it --sql-query="My_query_here"? ...
2
votes
1answer
248 views

Error-based SQL injection

I understand the conceptual idea behind error-based SQLi, but not the actual execution. In particular, I can't make sense of this expression: or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) ...
1
vote
2answers
149 views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
227
votes
16answers
50k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
28
votes
3answers
128k views

How do I test for SQL injection vulnerabilities on a site with input fields?

What methods are available for testing SQL injection vulnerabilities?
47
votes
2answers
28k views

Are prepared statements 100% safe against SQL injection?

Are prepared statements actually 100% safe against SQL injection, assuming all user-provided parameters are passed as query bound parameters? Whenever I see people using the old mysql_ functions on ...
15
votes
7answers
3k views

SQL Injection Prevention

SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
15
votes
4answers
12k views

Levraging a shell from SQL injection

As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
18
votes
3answers
26k views

SQL injection with AND 1=1

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g. select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970; or ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software (...
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
17
votes
3answers
2k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
10
votes
5answers
2k views

SQL Injection in a Non-Web Application

Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
7
votes
3answers
5k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 http://example.com/index.php?mod=profiles&...
6
votes
1answer
9k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
30
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
8
votes
3answers
895 views

What would the potential abuses be for an HTTP API that accepted raw SQL?

I was wondering what some of the potential abuses could be for an HTTP API that accepted SQL queries and output results sets. The fact that this is the canonical definition of SQL injection is not ...
3
votes
4answers
13k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
2
votes
4answers
7k views

Does escaping quotes protect me from SQL injection?

A newbie question here. I've just read through a short introduction to SQL injection on http://www.breakthesecurity.com/2010/12/hacking-website-using-sql-injection.html?m=1 It says to find a GET ...
7
votes
1answer
2k views

Do I have to make any more check if I use prepared statements for integers?

I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this: $stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE. ...
5
votes
6answers
19k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
2
votes
3answers
1k views

Why are triggers not often used to secure a database?

I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
1
vote
1answer
387 views

Is this enough to tackle script / malicious code insertion in GET, POST requests?

I've got legacy PHP code which attempts to prevent script/SQL injection with the following: if (!empty($_POST)) { reset($_POST); while (list($k,$v)=each($_POST)) { if(!is_array($_POST{...
0
votes
1answer
152 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
9
votes
2answers
23k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
4
votes
2answers
629 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
3
votes
3answers
477 views

Does SQL have any inherant weaknesses?

A prof said that SQL injection is misnamed because it actually occurs from the program generating the SQL (e.g. Perl, PHP etc.) and I'm wondering is SQL "complex" enough to have any vulnerabilities ...
1
vote
2answers
2k views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g....
1
vote
2answers
356 views

SQLmap POST parameter 'txtLoginID' is not injectable

I have a lab machine that I have been practicing some SQL injection on. I know that the POST parameter that I am trying to exploit is vulnerable as I was able to extract the user DB manually. I ...
1
vote
1answer
2k views

Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?

$query = " $sql = select * from users where id = '$id' " Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.
1
vote
2answers
87 views

Simple SQL Injection

I'm training my SQLInjection knowledge on a training tool made by my university. In a certain lvl there is this simple product viewer which gets a row based on a id. So the query should me something ...