Hot answers tagged

6

Is this SQL injection? Yes. Why? Let's look at what's happening here. $query = "SELECT pass FROM social WHERE email = '$id'"; This passes $id directly to the query. If $id is not sanitized, SQL injection will occur. if($_POST && isset($_POST['submit'], $_POST['password'], $_POST['id'])) { $pass = ($_POST["password"]); $id ...


5

Should I escape input when using prepared statements? No. You really don't need to escape input if you use prepared statements. If you want an additional layer of security, use some kind of input filter (eg get me only integers, get me only valid emails, get me only alphanum, etc). And you obviously should not escape your password, as it doesn't even go ...


5

Try appending a UNION SELECT to the SQL query. A union-select allows the attacker to add a completely new select-statement. The results of that second select are appended to those of the first. When the first request returns no result, the union-select allows the attacker complete control over the result-set. Remember that a select-statement doesn't even ...


4

The "common solution" you mentioned has one glaring and obvious flaw: it can't use salt. If your hash has a salt (it should), then you need to fetch the salt before performing the hash operation. And if you're fetching the salt, you should just fetch the hash result at the same time. In fact, the two are typically stored in the same string. Ideally, you ...


3

Assuming that your stored procedure uses something like bcrypt with a secure salt and many rounds, I see no problem with what you are implementing. Your basically treating the database as an identity provider in a federated identity system where the applications are PHP applications. That said, I see no reason why you would do this. PHP has builtin ...


3

You need to figure out if the parameter is being parsed as an integer or a string (most probably as string). If the query is balanced and successful, It won't die(). try .. 1' order by 1-- - or .. 1 order by 1-- - If the first one returns an error, that means the parameter is being parsed as an integer so you don't need a quote (') to perform the ...


1

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 password from UserProfile where UserId=(select top 1 UserId from(select top 1 UserId from userprofile order by UserId) sq order by UserId DESC))-- http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 Email from UserProfile where ...



Only top voted, non community-wiki answers of a minimum length are eligible