SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

362
votes
18answers
45k views

How can I explain SQL injection without technical jargon?

I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?
48
votes
6answers
9k views

SQL injection — but why isn't escape quotes safe anymore?

I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion. Raw SQL When you're writing SQL -- for ...
24
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
24
votes
8answers
6k views

Why Not Allow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
21
votes
2answers
7k views

Are prepared statements 100% safe against SQL injection?

Are prepared statements actually 100% safe against SQL injection, assuming all user-provided parameters are passed as query bound parameters? Whenever I see people using the old mysql_ functions on ...
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
17
votes
3answers
31k views

How do I test for SQL injection vulnerabilities on a site with input fields?

What methods are available for testing SQL injection vulnerabilities?
17
votes
4answers
6k views

How did anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, anonymous took down a child pornography site using SQL-injection. I read in this article that anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
16
votes
4answers
2k views

Does stored procedure prevent SQL Injection in postgreSQL

Is it true that Stored procedure will prevent databases to be injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injection if we only use ...
16
votes
2answers
1k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
15
votes
3answers
11k views

SQL injection with AND 1=1

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g. select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970; or ...
14
votes
7answers
1k views

SQL Injection Prevention

SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
13
votes
3answers
2k views

How do I prevent this type of SQL injection attack?

Our company has been using several tool (Veracode, Appscan, etc) to verify that our applications meet minimum security requirements. I have inherited a legacy application which has several flaws. I've ...
13
votes
4answers
4k views

Levraging a shell from SQL injection

As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
13
votes
2answers
4k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
12
votes
3answers
2k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
10
votes
5answers
1k views

SQL Injection in a Non-Web Application

Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
10
votes
1answer
1k views

How to properly secure a $_GET in PHP?

I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
10
votes
2answers
783 views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
10
votes
2answers
857 views

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
9
votes
3answers
850 views

Demonstrating SQL injection on the following

I've got lines in my php/mysql code which look like this: ... $sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id']; ... ... query is executed ... echo $price; As a ...
9
votes
3answers
954 views

Should IP addresses be validated to prevent SQL Injection?

In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses. Should I validate user IP addresses before using ...
9
votes
6answers
7k views

xp_cmdshell: should it ever be used?

Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
9
votes
1answer
718 views

How is time-based SQL injection different from other types of SQL injection?

I understand what a time-based SQL injection is, and I understand how it works (at least how it's detected/exploited). However, is there anything in specific which makes this type of injection any ...
8
votes
3answers
9k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
8
votes
3answers
698 views

Suggestion setting up a SQL injection honeypot

I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ). That made me curious ...
8
votes
1answer
793 views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
7
votes
3answers
2k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
7
votes
4answers
888 views

How to white hat Pen Test SQL injection

I will start off with saying apologies if this is something that has been asked 100s of times or is moot question within testing circles. I have come across this article I'd like to test this out ...
7
votes
4answers
2k views

SQL injection Are there any instances where a vulnerable url would not contain an 'equals' (=) symbol

I have a question I'm hoping you could help with? I am looking to filter/grep a very long list of spidered url's from my site to only get the url's that could possibly be vulnerable to sql injection. ...
7
votes
2answers
5k views

SQL Injection: Drop All Tables

I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
7
votes
3answers
3k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
7
votes
3answers
1k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
7
votes
2answers
213 views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
6
votes
2answers
963 views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
6
votes
1answer
4k views

Testing SQL injection using sqlmap

I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks. I got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
6
votes
2answers
248 views

SQL injection across multiple tables

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to ...
6
votes
1answer
1k views

Do I have to make any more check if I use prepared statements for integers?

I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this: $stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE. ...
6
votes
2answers
512 views

Backdoors after SQL injection?

I just found an injection vulnerability on a live site of a client. It looks like this: $sql = "SELECT * FROM users_dl WHERE Username = '" . $Uname . "' AND Password = '" . $Pword . "'"; I ...
6
votes
2answers
222 views

Presentation on Web App Security (ACM Student Chapter)

I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
6
votes
1answer
4k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
5
votes
4answers
2k views

A customers site had a big mysql injection attack on it, just want to learn from it

I created an online store for a friend of mine. I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The ...
5
votes
5answers
2k views

How to make a site vulnerable to SQLi?

I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I ...
5
votes
4answers
317 views

Does any database let you disable non-parameterized queries and therefore disable SQL injection?

Is there a database that allows this already? If not, here is how I think it could be done. I think it would require modifying the database software and the driver or code that is assembling the SQL ...
5
votes
3answers
563 views

How do I make SQL injection harder but not impossible?

I'm doing a CTF application for my final year project. I wanted to craft a SQL injection flag but I don't wish that they can simply found out the SQLi vulnerability by injecting ' . Hence, is there ...
5
votes
3answers
554 views

Best way to alert a website owner of a vulnerability?

recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
5
votes
4answers
1k views

How to get the output of a SQL injection?

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something ...
5
votes
3answers
1k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
5
votes
2answers
705 views

Could this login form be “hacked” to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; ...