Hot answers tagged

105

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied input unsafely in a query: http://example/index.php?id=1 => SELECT * from page where id = 1 In your example the attacker would use spaces: http://example/index....


46

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other type of data binding. Prepared statements separate the query from the data, making it impossible for the data to affect the query. To directly answer your ...


18

It would limit the problem, but not eliminate it. Consider the following situation: $un = str_replace(" ", "", $_POST["username"]); $pw = hash($_POST["password"]; $sql = "SELECT * FROM users WHERE username = '$un' AND password = '$pw'"; Lets say I post the username admin'--. That would log me in as admin, without using a single space. As wireghoul points ...


15

Those are called NoSQL Injections instead of SQL injections. You can find more information about NoSQL injections, in the OWASP Testing Guide.


13

No. Let's say you have this as your SQL: "select * from people where last_name = '" + surname + "'" If I enter: 'OR(1=1)OR'a'=' into the input it turns into: select * from people where last_name = ''OR(1=1)OR'a'='' Which executes in Oracle and MySQL (at least) and returns all the rows from the table.


8

Is the injection in a NoSQL database architecture also called SQL injection... No, it is not called "SQL injection" but this is called a "NoSQL injection", you can read more about in an article titled "Testing for NoSQL injection", written by OWASP. ... and is it still part of the OWASP 2013 Top 10, category A1 Injection? Yes, this is a type of ...


6

No, injection with just hexadecimal characters is not possible. Another (better?) way to prevent SQL injection is to use prepared statements: $stmt = $mysqli->prepare("SELECT * FROM User WHERE Password=?"); $stmt->bind_param("s", $password); $stmt->execute(); Because you leave it to the database engine to correctly put your data in the SQL query,...


4

Removing comments helps against some injections, but by all means not all. In this case you can still zero any field by setting $vote to construct a logical sequence out of what was an assignment: variable : vote`=1 + `vote query : ... SET `vote`=1 + `vote`=`vote`=1 + `vote`+1; This will alternate vote between 0, if it is nonzero, and 1,...


3

However if you took that search string update aTable set someColumn='JackedUpValue' where someColumn like and performed the operation shown in this question, wouldn't you get updateaTablesetsomeColumn='JackedUpValue'wheresomeColumnlike which should not execute, right? As others have pointed out there are other ways of getting whitespace into ...


2

From source code we can see that sqlinjection1 has four known columns username,password,welcomemessage,id. As people pointed in commnets,We can use error based Sql injection to get the usernames,passwords,welcomemessage,id etc. Post below parameters in sqli $user=1' or exp(~(select * from (select concat_ws(':',username,password,welcomemessage,id) from ...


2

Perhaps inject a union? You will need to know what columns are returned by the base query. Say you determine that the original query is essentially returning: SELECT id, productName, productDescription, createdDate FROM Products where ID = 1 You can craft a UNION query that matches the same column structure but queries another table. Then if you pass ...


1

Firstly, I would recommend to use below function, that would be more efficient and stricter in my opinion. <?php function IsHexadecimal($pass) { return preg_match('/^[0-9a-f]{64}$/i', $pass); } // or as @martinstoeckli suggested function IsHexadecimal($pass) { return (ctype_xdigit($pass) && strlen($pass) ==...


1

Interesting video. In my opinion, to setup this kind on technique, you need to: 1) Own a domain name, say mysite.com 2) Each domain name has an "Authoritative name server". Usually the Authoritative name server are managed by the company that sold you the domain name. 3) You need to setup you own Authoritative DNS server on a public IP address, then ...


1

Generally when you are trying to secure an application you want to make sure that you aren't disclosing any information that could potentially be used as part of an attack. This is the same reason that it is more secure to display a generic error page instead of a stack trace. Even though seeing the stack trace probably isn't a vulnerability itself - it ...



Only top voted, non community-wiki answers of a minimum length are eligible