New answers tagged mysql
7
I had some fun "decoding" two queries, so here's how I did it in PHP :p
1) or 1=convert(int,(select cast(Char(114)+Char(51)+Char(100)+Char(109)+Char(48)+Char(118)+Char(51)+Char(95)+Char(104)+Char(118)+Char(106)+Char(95)+Char(105)+Char(110)+Char(106)+Char(101)+Char(99)+Char(116)+Char(105)+Char(111)+Char(110) as nvarchar(4000))))--
So let's start with ...
2
It appears that the attacker was trying to do some investigation into what sort of attacks were possible with the vulnerability he had found.
Regardless; the lesson is always the same: use parameterized queries. If you have to remember to quote and escape your data, then you're doing it wrong.
If you'd like to learn more about how typical SQL injection ...
7
The mere fact your DB ran the quoted queries (throwing you the error reports) means you do have injection vulnerability in PHP code. Note, that some methods of inspecting DB tables structure involve running multiple queries with different parameters until DB throws an error and HTML page breaks. That means the failed queries are only tip of iceberg of all ...
5
Which makes me glad to know that I'm knowledgeable enough in my php to know how to prevent these things.
This is an extraordinarily dangerous mindset to take away from this incident.
That the attacker doesn't appear to have deleted data doesn't mean they didn't read data they shouldn't have. And the fact that they were able to enter inputs that caused ...
-1
yes it is
you are not validating nothing
you have to user mysql_real_escape_string to prevent sqli & htmlentities/htmlspecialchars to prevent xss
take a look at this tutorial as it helps on learning to prevent sqli http://www.thecodertips.com/2012/08/sql-injection-security-tutorial-web.html
Top 50 recent answers are included
