Skip to main content
Information Security

Return to Question

deleted 6 characters in body
Source Link
Tom K.
Tom K.
  • 8k
  • 3
  • 33
  • 54

Let's assume we're building a aqlSQL query like this:
  
SELECT * FROM users WHERE username = 'Username' AND password='password' 

 If we blocked the characters (")" and (')', will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using mysqliMySQLi prepare.

Let's assume we're building a aql query like this:
  SELECT * FROM users WHERE username = 'Username' AND password='password'
 If we blocked the characters (") and ('), will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using mysqli prepare.

Let's assume we're building a SQL query like this: 
SELECT * FROM users WHERE username = 'Username' AND password='password' 
If we blocked the characters " and ', will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using MySQLi prepare.

Source Link
Mark Adawele
Mark Adawele
  • 29
  • 1
  • 2

Is SQL Injection Possible without double and single quotes?

Let's assume we're building a aql query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters (") and ('), will an attacker be able to hack into it at all?

Here's my regex statement /[\"\']/ and if there are any matches it will block the request. I'm also trying to avoid using mysqli prepare.